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(54) Title: ELECTRONIC-MONETARY SYSTEM 



(57) Abstract 

A monetary system using electronic media (11) to ex- 
change economic value securely and reliably. The invention 
provides a complete monetary system having electronic mo- 
ney that is interchangeable with conventional paper money 
comprising: (I) issuing banks (1) or financial institutions that 
are coupled to a money generator device (6) for generating 
and issuing to subscribing customers electronic currency 
backed by demand deposits and electronic credit authoriza- 
tions; (LI) correspondent banks (2) that accept and distribute 
the electronic money; (III) a plurality of transaction devices 

(4) that are used by subscribers for storing electronic money, 
for performing money transactions with the on-line systems 
of the participating banks or for exchanging electronic money 
off-line with other like transaction devices; (TV) teller devices 

(5) , associated with the issuing (1) and correspondent banks 
(2), for process handling and interfacing the transaction de- 
vices (4) to the issuing (1) and correspondent banks (2), and 
for interfacing between the issuing (1) and correspondent 
banks (2) themselves; (V) a security arrangement (21) for 
maintaining the integrity of the system; and (VI) reconcilia- 
tion (22, 23) and clearing processes (13) to i " 
ance the motenary system. 
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ELECTRONIC-MONETARY SYSTEM 
t Background of the Invention 

The present invention relates to an electronic 
monetary system for implementing electronic money payments 
as an alternative medium of economic exchange to cash, 
checks, credit and debit cards, and electronics fund 
transfer. The Electronic-Monetary System is a hybrid of 
currency, check, card payment systems and electronic funds 
transfer systems, possessing many of the benefits of these 
systems with few of their limitations. The system 
utilizes electronic representations of money which are 
designed to be universally accepted and exchanged as 
economic value by subscribers of the monetary system. 

Today, approximately 350 billion coin and 
currency transactions occur between individuals and 
institutions every year. The extensive use of coin and 

' currency transactions has limited the automation of 
individual transactions such as purchases, fares, and bank 
account deposits and withdrawals. Individual cash 
transactions are burdened by the need of having the 
correct amount or providing change therefor. Furthermore, 

' the handling and managing of paper cash and coins is 
inconvenient, costly and time consuming for both 
individuals and financial institutions alike. 

Although checks may be written for any specific 
amount up to the amount available in the account, checks 

' have very limited transferability and must be supplied 
from a physical inventory. Paper-based checking systems 
do not offer sufficient relief from the limitations of 
cash transactions, sharing many of the inconveniences of 
handling currency while adding the inherent delays 

' associated with processing checks. To this end, economic 
exchange has striven for greater convenience at a lower 
cost, while also seeking improved security. 

Automation has achieved some of these qualities 
for large transactions through computerized electronic 
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funds transfer ("EFT") systems. Electronic funds transfer 
is essentially a process of value exchange achieved 
through the banking system's centralized computer 
transactions. EFT services are a transfer of payments 
utilizing electronic "checks," which are used primarily by 
large commercial organizations. 

The Automated Clearing House (ACH) and point of 
sale (POS) systems are examples of electronic funds 
transfer systems that have become used by retail and 
commercial organizations on a substantial basis in recent 
years. However, the payments made through these types of 
EFT systems are limited in that they cannot be performed 
outside of the banking system. Moreover, ACH transactions 
usually cannot be performed during off business hours. 

Home banking bill payment services are examples 
of an electronic funds transfer system used by individuals 
to make payments, currently, home banking initiatives 
have found few customers. Of the banks that have offered 
services for payments, account transfers and information 
over the telephone lines using personal computers, less 
than one percent of the bank's customers are using the 
service. One reason that home banking has not been a 
successful product because the customer cannot deposit and 
withdraw money as needed in this type of system. 

Current EFT systems, credit cards, or debit 
cards, which are used with an on-line system to transfer 
money between accounts, such as between the account of a 
merchant and that of a customer, cannot satisfy the need 
for an automated transaction system that provides for the 
transfer of universally accepted economic value outside of 
the banking system. 

To implement an automated, yet more convenient 
transaction system that does not require the banking 
system to intermediate the transfer, and that can dispense 
some form of economic value, there has been a trend 
towards off-line electronic funds transfer. For example, 
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numerous ideas have been proposed for some form of 
"electronic money" that can be used in cashless payment 
transactions as alternatives to the traditional currency 
and check types of payment systems. See U.S. Patent No. 
4,977,595, entitled "METHOD AND APPARATUS FOR IMPLEMENTING 
ELECTRONIC CASH, and U.S. Patent No. 4,305,059, entitled 
"MODULAR FUNDS TRANSFER SYSTEM." 

The more well known techniques include magnetic 
stripe cards purchased for a given amount and from which a 
prepaid valie can be deducted for specific purposes. Upon 
exhaustion of the economic val#e, the cards are thrown 
away. Other examples include memory cards or so called 
smart cards which are capable of repetitively storing 
information representing value that is likewise deducted 
for specific purposes. 

However, these proposed systems suffer from a 
failure to recognize fully the significance of bank 
deposits as money, and their necessity to back any form of 
universally accepted monetary representations that may be 
issued. In the systems disclosed thus far, 
representations of economic value, whether electronic or 
paper, are issued without the backing of equal valued 
liabilities as the counterpart to their assets. 

None of the paperless payment systems that have 
been proposed so far are comprehensive enough so as to 
implement a multipurpose electronic monetary system that 
includes not only the automated devices that allow 
subscribers to transfer electronic funds or money between 
them without any intermediating system, but that also 
encompasses and includes an entire banking system for 
generating the value represented by the electronic money 
and for clearing and settling the electronic money 
accounts of the banks and financial institutions involved 
to maintain a monetary balance within the system. 

Thus, specifically, there is a need for a system 
that allows common payor to payee transactions without the 



PCT/US92/09732 



. intermediation of the banking system, and that gives 
control of the payment process to the individual. 
Furthermore, a need exists for providing a system of 
economic exchange that can be used by large organizations 
for commercial payments of any size, that does not have 
the limitations of the current EFT systems. 
5 Accordingly, it is an object of the present 

invention to provide a complete electronic monetary system 
which utilizes electronic money that is interchangeable 
with traditional cash and is universally accepted. 

It is another object of the present invention to 
10 provide a method of securely transferring economic value 
including currency and credit among subscribers, among 
financial institutions, and between subscribers and 
financial institutions. 

A further object of the present invention is to 
15 provide a multipurpose paperless payment system whereby 
transactions can be carried out in both an on-line and an 
off-line mode between subscribers. 

It is yet another object of the present 
invention to provide a payment system that reduces the 
20 cost of central electronic funds transfer systems by off 
loading much of the payments to off-line devices. 

It is still another object of the present 
invention to provide a system of inexpensive electronic 
transfers to reduce an institution's cost of managing 
25 paper cash, checks and coins. 

It is still a further object of the present 
invention to provide a user friendly electronic payment 
system that may be used reliably and securely for real 
time transfers of money between members of the general 
30 public, between members of the general public and 
commercial organizations, and between commercial 
organizations . 

It is still another object of the present 
invention to provide a system for depositing and 

35 
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o withdrawing economic value which may be integrated with a 
wide variety of data processing and data communication 
systems including currently available home banking 
services . 

It is still a further object of the present 
2 invention to provide an electronic monetary system which 
utilizes electronic money in the form of multiple 
currencies . 

It is yet a further object of the present 
invention to provide a system for safely transferring 
economic value in transactions of virtually any size 

10 

denomination. 

It is yet another object of the present 
invention to provide a medium of economic exchange that is 
fungible, easily transferable, undeniably redeemable, and 
15 secure from reuse, duplication, and counterfeiting. 

The foregoing objects and advantages of the 

invention are illustrative of those which can be achieved 

by the present invention and are not intended to be 

exhaustive or limiting of the possible advantages which 

„ can be realized. Thus, these and other objects and 
20 

advantages of the invention will be apparent from the 
description herein or can be learned from practicing the 
invention, both as embodied herein or as modified in view 
of any variations which may be apparent to those skilled 
in the art. Accordingly, the present invention resides in 
the novel methods, arrangements, combinations and 
improvements herein shown and described. 



25 



30 



Summary of Exemplary Embodiment 
To achieve the foregoing, and other objects, the 
methods and apparatus of the present invention employ a 
preferred embodiment in the form of an electronic-monetary 
system having (1) banks or financial institutions that are 
coupled to a money generator device for generating and 
issuing to subscribing customers electronic money 
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including electronic currency backed by demand deposits 
° and electronic credit authorizations; (2) correspondent 
banks that accept and distribute the electronic money; (3) 
a plurality of transaction devices that are used by 
subscribers for storing electronic money, for performing 
money transactions with the on-line systems of the 
5 participating banks or for exchanging electronic money 
with other like transaction devices in off-line 
transactions; (4) teller devices, associated with the 
issuing and correspondent banks, for process handling and 
interfacing the transaction devices to the issuing and 

10 correspondent banks, and for interfacing between the 

issuing and correspondent banks themselves; (5) a clearing 
bank for balancing the electronic money accounts of the 
different issuing banks; (6) a data communications network 
for providing communications services to all components of 

15 the system; and (7) a security arrangement for maintaining 
the integrity of the system, and for detecting 
counterfeiting and tampering within the system. 

In the preferred embodiment the functions of the 
money generating devices, the transaction devices, and the 

20 teller devices will be performed by a combination of 
tamper-proof computer hardware and application software 
modules that may be networked together. Information is 
transmitted in an encrypted form to provide security from 
unauthorized inspection. The electronic money is 

25 transmitted with digital signatures to provide 
authentication, and security from modification or 
counterfeiting. 

The electronic money exchanged by these devices 
may be an electronic representation of currency or credit. 

30 An important aspect of the electronic currency is that it 
is the equivalent of bank notes and is interchangeable 
with conventional paper money through claims on deposits 
in an issuing bank, but can be withdrawn or deposited both 
at an issuing bank and at a correspondent bank. However, 
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„ only the issuing banks can generate the electronic 
currency, and will be liable for its redemption. 

The issuing banks later utilize inter-bank 
clearing and settling processes to maintain the monetary 
balance in the banking system, as is currently practiced 

^ by today's banking industry. 

The electronic money representations are 
fungible, universally accepted, and undeniably redeemable 
from the issuing banks, i.e., they have the 
characteristics of money transactions. To preserve the 

g integrity of the electronic monetary system, each exchange 
of electronic money includes, along with other 
information, data identifying the monetary unit of the 
credit or currency, (i.e., dollars, yen, etc.) the amount 
by unit of credit or currency, and the bank issuing the 

^ electronic credit or currency, and several digital 
signatures. 



20 



In accordance with these and other objects of 
the invention, a brief summary of the present invention is 
presented. Some simplifications and omissions may be made 
in the following summary, which is intended to highlight 
and introduce some aspects of the present invention, but 
not to limit its scope. Detailed descriptions of a 
preferred exemplary embodiment adequate to allow those of 
ordinary skill in the art to make and use the inventive 
concepts will follow in later sections. 

According to a broad aspect of the invention, an 
electronic monetary system provides for transactions 
utilizing electronic money including electronic currency 
backed by demand deposits in a bank in lieu of cash 
transactions, and electronic credit authorizations. The 
invention comprises a money module for generating the 
electronic money; a money module for issuing, 
distributing, and accepting the electronic money; and a 
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money module for accepting, storing, and transferring the 
" electronic money between other accepting money modules and 
between the accepting money module and the issuing money 
module. 

According to a further aspect of the invention, 
an electronic monetary system is provided for implementing 
5 and maintaining electronic money which includes electronic 
currency that is interchangeable with conventional money 
through claims on deposits in a bank, and electronic 
credit authorizations. 

The system includes a plurality of issuing 

10 banks; a generator for creating electronic money; teller 
modules coupled to the generator module, for performing 
teller transactions and for interfacing with other teller 
modules, such transactions including the accepting and the 
distributing of the electronic money; a security- system 

15 for providing the overall integrity of the electronic 
monetary system; a clearing and settling process for 
balancing the electronic money accounts of the separate 
issuing banks and for clearing the electronic money issued 
by the issuing banks; and a plurality of transaction 

20 modules owned by authorized users, for transferring the 
electronic money between the transaction modules and 
between the transaction modules and the teller modules. 

In accordance with another aspect of the 
invention, the functions of the generator modules, the 

25 transaction modules, and the teller modules will be 
performed by a combination of tamper-proof computer 
hardware and application software that may be networked 
together- 

The electronic money exchanged by these modules, 
30 which may be an electronic representation of currency 
backed by demand deposit accounts at the issuing bank or 
credit authorizations, may be transmitted with digital 
signatures to provide security from unauthorized 
modification or counterfeiting. In a preferred 

35 
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embodiment:, security from counterfeiting and tampering is 
also provided by requiring the modules and the individual 
units of electronic money to be renewed periodically. 
Offending modules or counterfeit electronic money can be 
removed from circulation as soon as they are discovered. 
Briefly, a process in accordance with the 
' invention comprises the steps of 

(1) providing a generating module to generate 
electronic representations of economic value backed by 
demand deposits or by a credit line; 

(2) providing a teller module to accept the 

' generated electronic representations of economic value and 
to issue the electronic representations of economic value; 

(3) providing the authorized users with a 
transacting module for accepting, storing and transferring 
the electronic representations of economic exchange to 

5 other authorized users having the transacting module and 
to the teller processing module; 

(4) accepting and transferring the electronic 
representations of economic value to other authorized 
users having a transacting module and to the teller 

' module; and 

(5) providing a security system to allow the 
transfer of electronic representations of economic value 
in a secure manner between the generating module, the 
teller module and the transacting module. 

Brief Description of the Drawings 
Other objects and advantages of the present 
invention will become more apparent by the following 
description with reference to accompanying drawings, in 
1 which: 

Figure 1 is a diagram illustrating general 
aspects of the invention; 

Figure 2 is a schematic diagram of the operative 
arrangement of the components, according to the invention. 
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Figure 3 is a perspective diagram of several 
° embodiments of external systems that may house a money 
module, according to the invention. 

Figure 4 is a block form diagram of a 
transaction money module, according to the invention. 

Figure 5 is a block form diagram of a Teller 
5 money module, according to the invention. 

Figure 6 is a block form diagram of a Money 
Generator module, according to the invention. 

Figure 7 is a block diagram of the network 
arrangement, according to the invention. 
1°' Figure 8 is a block diagram of a Network Sever, 

according to the invention. 

Figure 9 is a flow diagram of the security 
system, according to the invention. 

Figure 10 is a block form diagram of a security 
15 server, according to the invention. 

Figures 11-24 are flow diagrams of accounting 
examples, according to the invention. 

Figure 25 a flow diagram of the Transaction 
Reconciliation System, according to the invention. 
20 Figure 26 is a flow diagram of the Clearing 

System, according to the invention. 

Figure 27 is a flow diagram of the Money Issued 
Reconciliation System, according to the invention. 

Figures 28-50A are flow charts of transaction 
25 examples, according to the invention. 

^cnin^rP. of i-to* Prefe r ^ Embodiment of the Invention 
The present invention contemplates an improved 
monetary system using electronic media to securely and 
30 reliably exchange economic value. The system can be 

implemented by integrating novel data processing systems 
with other procedures which can be implemented with the 
current worldwide banking systems. 

Throughout this description, "electronic money" 

35 
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«» may also be referred to by the abbreviation "E-M." 
Additionally, the term "bank" is used hereinafter to 
indicate any banking, financial institution or the like 
which is a participant of the present invention. 

Referring now to the drawings, wherein like 
5 numerals refer to like components, there is disclosed in 
Figure 1, in block form, broad aspects of the preferred 
embodiment. In Fig. 1, the general relationship among the 
features of the system is shown. The system includes 
Issuing Banks 1 each having a Teller money module 5 and a 
j_ 0 Money Generator module 6; Correspondent Banks 2 each 
having a Teller money module 5; an electronic money 
Clearing Bank 3; a Certification Agency 28 and a plurality 
of Transaction money modules 4 owned by subscribers of the 
system. 

^5 Electronic notes 11, the media for transferring 

electronic money, are generated by the Money Generator 
module 6 for an Issuing Bank 1. These notes 11 are then 
transferred by a Teller money module 5 to a subscriber 
utilizing a Transaction money module 4. Electronic notes 

2q 11 may be representations of currency or credit 

authorizations. For security reasons, all electronic 
notes 11 will expire after a preset time period. Once 
expired, the notes 11 must be redeemed at a participating 
bank for updated ones before they can be transferred. 

23 An Issuing Bank 1 generates and distributes the 

electronic notes 11, and is liable for their redemption. 
An Issuing Bank 1 performs deposits, withdrawals, payments 
to loans and inquiries for other money modules. 

A Correspondent Bank 2 is a participating bank 

3q which distributes electronic money through accounts it 
maintains at Issuing Banks 1, but does not generate any 
electronic money, and is not liable for its redemption. 
Because it cannot generate any electronic money, the 
Correspondent Bank 2 in the preferred embodiment must make 

35 real-time requests of electronic money from an account it 
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„ maintains at an Issuing Bank X whenever a subscriber 
wishes to withdraw electronic money at a Correspondent 
Bank 2. 

Conversely, a Correspondent Bank 2 deposits all 
electronic money deposited by subscribers, to the accounts 
the Correspondent Bank 2 holds at Issuing Banks 1. These 
5 accounts will be described hereinafter. A correspondent 
Bank 2, like an Issuing Bank X, will perform deposits 
withdrawals/ payments to loans and bank inquiries. 

Notably, an Issuing Bank X may also be a 
Correspondent Bank 2 for the monetary units that it does 
10 not generate. For example, an Issuing Bank X for 

electronic dollar notes XI may be a Correspondent Bank 2 
for electronic notes XI of yen, marks, issued by other 
banks etc. 

It is also important to note that system of the 

15 invention can function without correspondent Banks 2. For 
example, a subscriber can eliminate the use of a 
Correspondent Bank 2 by communicating directly with 
his/her Issuing Bank 1 when making a deposit, withdrawal, 
etc. correspondent Banks 2 are included in the preferred 

20 embodiment for the practical purpose of expanding 

distribution of the system while reducing the risks that 
are inherent in any banking system, such as the risks 
caused by the collapse of a bank issuing money. 

The Clearing Bank 3 is utilized when more than 

25 one bank is issuing electronic money. According to the 
invention, it is anticipated that more than one bank will 
be issuing electronic money. Thus, the Clearing Bank 3 is 
provided to clear the electronic money deposited and to 
balance accounts it maintains for the Issuing Banks X. 

30 The Clearing Bank 3 maintains demand accounts for each 
Issuing Bank X in the system. 

The Certification Agency 28, is the centerpiece 
of the system security. It provides a process that 
"certifies" the validity of a money module for a certain 
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( period of time by issuing a certificate to each money 
module. A money module must have a valid certificate in 
order to be able to transact with other money modules 4, 
5, 6. 

Before the certificate expires, it must be 
updated so that a subscriber can continue to use his/her 
transaction money module 4. This process makes users of 
the system establish periodic contact with the 
Certification Agency 28. 

Periodic contact allows for faster response when 
tampering with the money modules of the system is 
detected. To this end, the Certification Agency 28 also 
provides a list of offending or compromised money modules 
to other money modules so that transactions with the bad 
units may be blocked. 

The components shown in Figure 1 are best 
understood by referring to the system's operative 
arrangement illustrated in Figure 2. As illustrated in 
Figure 2, the preferred embodiment provides for 
supplements to the current banking systems that include 
the following additional components: a plurality of the 
Transaction money modules 4, the Teller money modules 5, 
and the Money Generator modules 6, for creating, 
transferring and storing the electronic notes 11 (money) ; 
a Clearing System 13 to balance the accounts of banks 
issuing currency and credit; a security system 21 to 
maintain the integrity of the electronic notes 11 ; the 
current banking systems 20; a network 25 (exemplified by 
the lines interconnecting modules and systems) to mediate 
transactions between money modules 4,5,6, the 
participating banks 1,2,3 of system 20 and the security 
system 21; a Transaction Reconciliation system 22 to 
detect money module malfunctions and insider tampering of 
the system; a Money Issued Reconciliation System 23 to 
detect counterfeiting and reuse of electronic money; and a 
Money Position System 24 to keep track of the electronic 
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, money in circulation. 

Playing mayor role in the preferred embodiment 
are three classes of "money modules- for creating, 
storing, and transferring the electronic objects that 
represent economic value. These include the Transaction 
money modules 4, the Teller money modules 5, and the Money 
5 Generator modules 6. It is contemplated that these money 
modules 4,5,6 will be a combination of tamper-proof 
hardware and application software that are meant to be 
components of a larger processing environment. 

Referring to the top right-hand side of Figure 
D 2, a Transaction money module 4 containing electronic 
notes XX stored therein (not shown) may be used to 
exchange foreign currency or make a payment with another 
Transaction money module 4, using a secure, encrypted 
protocol either by a telephonic link, or a proximate 
5 communication link. Because it is contemplated that an 
electronic note XX will be fungible, i.*., it can be 
broken into any desired amount, the amount transacted 
between the Transaction money modules 4 may be of any 
amount up to the amount stored in the payor's Transaction 
money module 4. 

A payee's Transaction money module 4 that has 
received the electronic note XX as a payment may, in turn, 
be used to transfer all or any amount of the electronic 
money contained therein to another subscriber's 
5 Transaction money module 4. Alternatively, the payee may 
deposit the electronic money into his/her bank account. 

The value of the electronic money stored in the 
Transaction money module 4 may also be redeemed at any 
participating bank (e.g. , Correspondent Bank 2 or Issuing 
° Bank 1) for paper money by transferring any amount of the 
electronic money to a bank's Teller money module 5, 
whereby a teller or an Automated Teller Machine (ATM) will 
return an equal amount of paper money. Naturally, it is 
anticipated that paper money may also be exchanged for 
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" equal valued electronic money. 

As will be appreciated, the Transaction money 
module 4 may be configured to make deposits, withdrawals, 
loan payments, inquiries and exchanges of currencies of 
electronic notes 11 directly through a Teller money module 
5 5 at an Issuing 1 or Correspondent Bank 2 or remotely 
through a telephonic connection to an Issuing 1 or 
Correspondent Bank 2 Teller money module 5 (thereby 
providing, among other things, the transactions not 
available in current home banking systems) . Upon a 
10 request to transact with a bank, the Teller money module 5 
mediates the transactions for the subscriber's bank 
account as well as the banking system's electronic money 
accounts. 

It should be noted that a subscriber will not be 

15 required to maintain a bank account in order to own and 
use a Transaction money module 4. For instance, a 
subscriber may obtain a stand-alone computing device that 
contains a Transaction money module 4 and use the device 
only in off -line. peer-to-peer transactions with other 

20 devices containing a Transaction money module 4 , such as a 
merchant's point-of-sale terminal. Of course, the 
merchant may then transfer the electronic money to another 
commercial organization to meet its obligations, or it may 
deposit the electronic money at its own bank. 

25 In the preferred embodiment, electronic money 

deposited at any Issuing Bank 1 other than the original 
Issuing Bank 1 itself will subsequently be settled for 
value with the original Issuing Bank 1- through the central 
clearing and settling process performed by the Clearing 

30 System 13. It is anticipated that the clearing and 

settling processes will be managed by the Clearing Bank 3 
(Figure 1) . Each Issuing Bank 1 Teller money module 5 
sends all the electronic notes 11 deposited at its bank 
but issued from other Issuing Banks 1 to the Clearing Bank 

35 3 in order to settle for the value posted to their 
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° customers' accounts. 

When a withdrawal, an exchange for foreign 
currencies, an exchange of paper cash for electronic 
money, or an updating of the electronic money occurs, the 
Money Generator module 6 Figure 2, creates and digitally 
5 signs electronic objects having economic value - either 
currency or credit notes 11 (Figure 1) - that are to be 
sent to the Transaction money modules 4 through the 
participating bank's Teller money modules 5 in the form of 
a packet of electronic notes IX. As mentioned above, the 

XO electronic currency notes 11 are the equivalent of bank 
notes that are backed by deposits, and can be traded 
between Transaction money modules 4. 

During the withdrawal transaction, the Teller 
money module 5 and the Transaction money module 4 may 

15 establish a communications link using an encrypted 

protocol to securely transfer the notes 11 from the Teller 
money module 5 to the Transaction money module 4. 

Records of the notes 11 generated and conveyed 
by the Money Generator module 6 are sent to the local 

20 bank's Transaction Reconciliation System 22 and an Issuing 
Bank's 1 Money Issued Reconciliation System 23 for 
maintaining statistical and housekeeping functions. 
Records of the electronic notes 11 cleared and settled at 
the Clearing Bank 3 are also provided to the Money Issued 

25 Reconciliation System 23 . From these compilations, a 
financial position of the system can be produced by the 
Money Position System 24. 

Discrepancies and malfunctions are reported to 
the Security System 21 which downloads the lists of 

30 problem money modules to all money modules in the system 
when they are connected to the Network 25. By carrying 
this list, a Transaction money module 4 will be inhibited 
from transacting with other suspect Transaction money 
modules 4. 

35 Having thus provided in overview of the 
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« preferred embodiment, there will now follow a more 
detailed description of the individual elements and the 
transactions between them. 

Money modules 
5 Figure 3 provides several embodiments of 

external systems or devices for housing money modules. 

In the preferred embodiment, the external system 
or device will typically contain data display means, data 
input means, data processing means, memory storage means, 
10 direct connection or contactless bidirectional 

communications means, and the money module packaged in a 
tamper-proof housing, all interfaced by suitable means for 
information transfer, such as are well known in the art. 

As will be understood, a money module may be 
15 embodied as a modular component of any larger processing 
environment while still performing the same functions. 
For example, Transaction money modules 4 may work as co- 
processors embedded in personal portable computing devices 
like the Hewlett-Packard 95LX, or as co-processors in 
20 mainframe computers, workstations, point-of-sale terminals 
or telephone devices (fixed or portable) connected to a 
network. 

A Teller money module 5 may be embodied as a co- 
processor in the bank's financial computer systems. The 

25 Money Generator module 6 could be a separate processing 
unit networked to the bank, a co-processor in a general 
purpose computer, or it may be combined with an Issuing 
Bank's 1 Teller money module 5 in a larger processor. 

Because it is anticipated that a money module 

30 will be implemented in a separate processing device, it is 
assumed that corresponding interface circuitry would be 
provided in the host processing device to provide 
communication between the processing device and the money 
module . 

35 Notably, all classes of money modules 
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« contemplated by the invention may be implemented 
programmatically or by direct electrical connection 
through customized integrated circuits, or a combination 
of both, using any of the methods known in the industry 
for providing the functions described below without 

5 departing from the teachings of the invention. Those 
skilled in the art will appreciate that from the 
disclosure of the invention provided herein, commercial 
semiconductor integrated circuit technology would suggest 
numerous alternatives for actual implementation of the 

Q inventive functions of the money module that would still 
be within the scope of the invention. 



15 



20 



25 



30 



35 



Transaction Money Module 

In one embodiment, the Transaction money module 
4 may be imbedded in any computer of any size or use, like 
those serving as general purpose computers or work- 
stations, to provide functions not limited to E-M 
transaction use. This latter application will allow for 
such uses as real-time, off-line payments between personal 
computing devices, or on-line payments for network 
services such as information retrieval, telephone calls, 
or for purchasing airline tickets, theater tickets, etc. 

In another embodiment, the Transaction money 
module 4 may be imbedded in an individual hand-held 
integrated circuit unit, such as a personalized hand-held 
computer that may be readily carried by an individual as 
though it were a wallet. As an illustration, the device 
of the preferred embodiment may include a keyboard, a pen 
or stylus, a touch screen or voice recognition circuitry 
as a data input means, an alphanumeric LCD dot matrix 
display as a display means, an infrared optical 
transceiver as a contactless bidirectional communications 
means, and an KT-11 telephone jack coupled to modem 
circuitry as a telephonic communications means. 
Additionally, the device may also include various 
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electronic processing and storage means for providing 
calculator capabilities, for storage and processing data 
of the owner, etc. 

It is important to note that the particular 
design of the external device is not critical to the 
invention, and other technologies suitable for 
accomplishing the foregoing functions may also be used. 
For example, an LED instead of an LCD display panel may be 
used; radio, infra red, inductive or capacitive 
communications methods may be used instead of direct 
connection, optical communications methods may be used; 
etc. 

In general, it is anticipated that any 
Transaction money module 4 owned by a subscriber will be 
embodied in a self-contained, tamper-resistant unit that 
contains components which are difficult to access, and 
thus prevent any person from improperly examining, 
counterfeiting or modifying any of its contents or 
arrangements. For example, integrated semiconductor 
circuits, whose contents are difficult to examine, encased 
in a tamper-resistant package such as that formed by an 
epbxy or plastic lamination may provide a high degree of 
physical security while providing the necessary storage, 
computation, timing, and other data processing functions. 

However, the invention is not limited to any 
particular tamper-resistance means, inasmuch as there are 
a number of methods known in the industry for providing 
such security. Such tamper-resistance will also prevent 
the owner, who can control only some of the internal 
operations of the Transaction money modules 4, from 
certain accesses to thereby provide security from abuse to 
other relevant institutions and individuals. 

Each Transaction money module 4 will have a way 
of ensuring its own association with a particular 
subscriber, so that its use by other individuals may be 
limited. In addition to the use of Personalized 
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„ identification Number (PIN) methods that are well Icnown in 
the art, the Transaction money module 4 may also include 
means such as a fingerprint reader, voiceprint analyzer, 
written signature analyzer, or other so-called biometrics 
to determine the physical identity of an authorized 



5 subscriber. 

Additionally, the Transaction money module 4 may 
utilize personalized interactive proofs using guestions 
that only a true owner would be able to correctly answer, 
such as the owner's mother's maiden name, his/her favorite 
color, etc. Any such techniques may provide additional 
security for organizations, and may also be to the 
advantage of the authorized user since such security can 
protect the subscriber's data from inspection and use by 
someone else coming into possession of the Transaction 
. . money module 4 . 

" Because the Transaction money module 4 can take 

on a variety of physical representations, it will be 
described by the functions performed in addition to the 
pertinent physical characteristics of a preferred 
embodiment. 

Z0 Referring now to Fig. 4, a Transaction money 

module 4 is shown diagrammatically in block form. 
Specifically, a Transaction money module 4 has (1) an 
external interface 30 that interfaces the Transaction 

2 money module 4 to the module's data processing means, the 
input/output means (human interface) and the 
communications circuitry of the external device; (2) a 
session manager 31 to control and commit (i.e., finalize) 
or abort a transaction session; (3) a transactor 32 to 
manage application functions; and (4) a money holder 38 to 
contain and manage the electronic representations of 
money. 

According to the invention, the following 
application functions may be implemented in the preferred 
35 embodiment of the present invention: 
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The To Subscriber application 33 performs the 
function of comparing the owner identification 
characteristics, such as a user's personal identification 
number (PIN) and biometrics characteristic (e.g., 
fingerprint, voiceprint, etc.), that are stored in the 
memory of the Transaction money module 4, to those of the 
individual who is attempting to gain access to the 
Transaction money module 4. After the proper ownership is 
verified, the Transaction money module 4 may be activated, 
and the user is allowed certain accesses to the 
Transaction money module's 4 stored contents. Messages to 
the subscriber, and subscriber inquiries as to the 
information contained within the Transaction money module 
4 are also handled by this application function. 

The To Teller application 34 interfaces the 
Transaction money module 4 to the Teller money modules 5 
for initiating and performing deposit, withdrawal, loan 
payment transactions, and bank inquiries with such Teller 
money modules S. 

The Pav /Exchange application 35 supervises the 
sending and receiving of electronic notes 11 between 
Transaction money modules 4, managing the process in which 
the electronic notes 11 are properly "packaged" as to 
amount, digital signatures, etc. This application 
provides that the electronic notes 11 are transferred in a 
recognized, valid format. Notably, this is the 
application that allows a money module to perform payments 
and foreign exchanges. Without this application in the 
preferred embodiment, a Transaction money module 4 cannot 
make a payment to another Transaction money module 4. 

The Tran Log Mgr. application 36 provides the 
management and overseeing of a log that records completed 
transactions undertaken by the money module. For each 
completed transfer of electronic money, an illustrative 
Tran Log records: 

(1) the type of transfer (i.e., payment, 
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deposit, foreign exchange, etc. ) , 

(2) the date of transfer, 

(3) the amount of transfer, 

(4) the Issuing Bank 1 identifier 

(5) the note identifier, 

(6) the monetary unit, 

5 (7> the identifier of the other money module 

involved in the transaction, and 
for deposits, withdrawals and loan payments: 

(8) the bank account number, 

(9) the bank identifier, and 

10 (io) the amount of the transaction. 

In the preferred embodiment, every money module 
will have an identifier. A money module identifier may be 
thought of as the "serial number" of the money module and 
is never changed. 

15 it is anticipated that a subscriber may have 

access to several of the fields of data stored in the Tran 
Log application, such as histories of the amount, date, 
and type of transfer. Information as to the expiration 
date of a certificate may also be accessed by the 

20 subscriber so that he/she will be informed as to the need 
to update or revalidate the money module's certificate. 

The Maintain Security application 37 manages a 
list of money module identifiers that are known to have 
been generally compromised. In particular, this is a list 

25 that is distributed to each money module when it 

communicates with the Network 25, and is a list of money 
modules that have passed an invalid or counterfeit 
electronic note 11 or have performed acts deemed 
detrimental to the system. 

30 when establishing a session between money 

modules, each money module checks its list of bad money 
modules to see if the other is an offending money module. 
If the other money module's identifier appears on the 
list, the communication is broken off. 



PCT/US92/09732 



, This application also provides the process for 

obtaining the certificate unique to the money module, for 
synchronizing the internal clock, and for managing the 
creation of new cryptography keys. 

The Note Directory 39 application performs the 

. function of keeping track of the location, identification 
and value of the electronic notes 11 stored within the 
money module. A note 11, whether it is an electronic 
currency note or an electronic credit note, is the basic 
unit of electronic money. It is the electronic object 

( representing the economic value, the electronic bits that 
contain the amount, expiration date, note identifier etc. 
(described in detail below) that gets digitally signed 
(described below) and encrypted when being transferred. 
Both electronic currency notes 11 and electronic credit 
notes 11 may be located by the Note Directory 39. 

' The Note Directory application 39 updates 

summary totals of the current amount of electronic notes 
11 (both currency and credit) , by monetary unit after 
every transfer. A date-of-expiration, a note 
identification number and an Issuing Bank identifier is 
also recorded with the location of each note 11. 

In summary, the Note Directory 39 keeps track of 
the note identification number, the Issuing Bank 1 
identifier, the date-of-expiration of the note 11, the 
location of the note 11 as stored in the Transaction money 
module 4, and the current amount of the total value of the 
notes 11 stored for each monetary unit. These records are 
maintained for both electronic currency and electronic 
credit. For a credit note 11, the account number of the 
credit line is also maintained. 

The Notes application 40 manages the storage of 
the representations of the electronic notes 11 themselves, 
both currency and credit notes 11. This application also 
generates the transfers when notes 11 are to be conveyed. 

The Packet Manager application 41 manages the 
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. construction and formatting of a packet of electronic 
notes 11 that are to be transferred to another money 
module. For example, the Packet Manager 41 will utilize 
an algorithm so that the least number of electronic notes 
11 are used to fulfill the requested amount of transfer, 
with the earliest dated electronic notes 11 being used 
5 first. Alternatively, when a packet of notes 11 is 
transferred to the receiving money module, the Packet 
Manager 41 application "disassembles" the packet, 
verifying the date and separating the data fields that 
represent the different electronic notes 11. 

10 The formatted packet gets several data fields 

appended to it when electronic notes 11 are "assembled." 
An identifier data field provides the indicia that 
identifies it as a packet. Additionally, data fields for 
the total value of the notes 11, the number of notes 11, 

15 and the individual locations of the notes 11 are provided. 

The verifier application 42 verifies that a 
received packet contains valid electronic notes 11 before 
a receiving money module accepts them. The Verifier 42 
also checks that the total amount received is equal to the 

20 sum of the electronic notes 11 that are to be transferred. 
If the total amount and the individual electronic notes 11 
are valid, an acknowledgment is returned to allow for 
completion of the transfer. Otherwise, an "invalid" 
message is sent, and the transfer may be aborted. 

25 services applications that are provided fall 

under two categories: piock/Timer 43 and Cryptography . 
The clock/Timer 43 provides output pulses for controlling 
a transaction timeout, such as the time between the 
sending of a message and the return of a corresponding 

30 

message. 

As will be appreciated, when two money modules 
are communicating, they may be monitoring a time-out 
protocol. For example, after a first money module has 
sent a message to a second money module, the Session 
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Manager 31 of the first money module ("A") may set a timer 
for a reply if the Transactor 32 indicates that a reply is 
required. The Session Manager 31 may also number the 
message sent. This number would appear in the reply 
message from the Session Manager 31 of the second money 
module ("B"). 

If the timer expires before the message has been 
received, then Session Manager A 31 will query Session 
Manager B 31 to determine if the transaction is still 
running in B. If B does not reply then Session Manager A 
31 will abort the transaction. If a reply is received 
that the transaction is proceeding, then the timer will be 
reset to a new time. If A queries B a predetermined 
number of times without receiving a reply to the original 
message, then A may abort the transaction. 

Separately, this application also maintains the 
current date and time, both for user display and for 
verifying that an electronic note 11 to be received is not 
an expired one, along with other general clock functions 
that are commonly used in the industry. 

The Cryptography application contains a Public 
Key 44 operation, a Symmetric Key 45 operation, and a 
Random Number Generator 46. While the tamper- resistance 
of the Transaction money module 4 and its components makes 
it difficult for a person to modify the structure of the 
device or its contents, known cryptographic techniques are 
also employed to provide secure communications and payment 
transfers between money modules. 

Public kev cryptography 44, as is well known in 
the art, may be employed by this application to provide 
public key digital signatures, which are called "digital 
signatures" or simply "signatures" for brevity. The data 
in electronic notes 11, may be represented by a digital 
number. The electronic notes 11, are signed by digital 
signatures formed from this number. A digital signature 
can then be checked as corresponding to a particular 
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message by anyone knowing the corresponding public key, 
" which in the preferred embodiment would be all other money 
modules. 

This application provides each money module with 
the ability to check the digital signature for 
authenticity. A money module receiving the digitally 
5 signed electronic note 11 can in turn sign and transfer it 
to others, who could also check, sign and distribute it. 

Because of the "one way" nature and 
computational complexity of public-key digital signatures, 
it is thought to be infeasible to decipher and duplicate 

10 them within a feasible period of time, making such a 
security system resistant to forgery. 

Lastly, this application also creates new public 
and private keys when needed. 

^^rie K »v ervptoaraphv 45 provides private 

15 key algorithms that are well known in the art, for 
individual session security and privacy between money 
modules. In the preferred embodiment, this application 
provides encryption/decryption means in order to secure 
information being exchanged between two money modules. 

20 well known symmetric key cryptography 

technique, such as the National Data Encryption Standard 
(DES) system or other cryptography techniques, may be 
provided in this application. For example, due to the 
increasing interest in providing cryptographically secured 

25 communications, manufacturers are providing various 

semiconductor integrated circuit devices which perform the 
encryption and decryption of data. Cylink corporation's 
CIDEC data encryption devices are examples of commercially 
available encryption/decryption circuitry that would be 

30 suitable in the present invention for this application. 
Due to the federally mandated use of the DES algorithm, 
devices such as these are widely utilized to implement 
that algorithm. 

It is important to note that the details of the 

35 
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particular cryptographic methodology utilized by the money 
modules are not critical and are not limited to a 
particular cryptographic technique. 

The Random Number Generator 46 generates random 
like numbers for creating new public/private keys for the 
Public Key application 44 and new private keys for the 
Symmetric Key 45 application. This application is 
utilized to vary in an unpredictable way the generation of 
temporary session keys. 

Circuitry for providing such random number 
generation capability are well known in the art. For 
instance, a circuit utilizing a "noisy" diode may provide 
random values, as is well known in the industry. Random 
numbers may also be provided by a pseudorandom number 
generator circuit which implements a mathematical 
algorithm, such as the power-residue algorithm, that 
generates apparently random values from a "seed" number. 
The use of clocks or counters provides another often used 
source of random data. As will be understood, the Random 
Number Generator 46 may use techniques that are well known 
to a person of ordinary skill in the art to generate the 
temporary numbers, and thus need not be further described. 

It should be further understood that the 
foregoing functions disclosed herein may be performed by 
known programming techniques and/or dedicated hardware and 
in some cases may be combination of both or shared 
resources from each. As may be appreciated by a person 
skilled in the art, many changes in form and detail can be 
made in dependance on specific application requirements 
without departing from the essential features of the money 
modules. 

Teller money module 
The banking systems 20 of both the Issuing Banks 
X and the Correspondent Banks 2 interface to the system of 
the invention through a Teller money module 5. The Teller 
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„ money module 5 may be imbedded in any general purpose 
° computer or workstation. The particular design of the 
Teller money module 5, like the Transaction money module 
4, may be implemented in readily known programming 
techniques or dedicated computer hardware, or a 
combination of both. As will be appreciated by a person 
5 skilled in the art, various designs of the Teller money 
module S may be employed to implement the functions 
described herein. 

The details of one embodiment of the Teller 
money module 5 is shown in block form in Figure 5. The 
10 Teller money module 5 contains many of the same components 
and application functions of the Transaction money module 
4 described above. Therefore, the identical components 
will only be repeated briefly here, while the 
distinguishing components will be fully described. It 
15 should be noted that the Teller money module 5, like other 
money modules of the system, is also contained within a 
tamper-proof enclosure of the type common in the industry, 
so as to ensure the necessary security involved. 

The Teiler money module 5 contains an External 
20 interface 30, a Session Manager 31, a Transactor 32 and a 
Money Holder 38 that perform similar functions to the 
corresponding components in the Transaction money module 4 
described above. 

Briefly, the External interface 30 interfaces 
25 the Teller money module 5 to other processing and 

communications means within the Teller money module 5 host 
processor; the Session Manager 31 acts to control and 
commit (i.e. , finalize) or abort a transaction session 
between the Teller money module 5 and another money 
30 module? the Money Holder 38 manages the storing and 
retrieval of electronic money? and the Transactor 32 
manages the application functions of a To Teller 34, the 
Tran Log Mgr. 36, the Maintain Security 37, the To Bank 
47, a To Money Generator 48, and the To Transaction 49. 
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, The following list describes in brief, the 

applications contained in the Teller money module 5 that 
are functionally identical to the applications found in 
the Transaction money module 4: 

To Teller 34: Interfaces deposit and 
i withdrawal functions to another Teller 

money module 5 . 

Tran Log Mgr. 36: Transaction log manager 
for recording transaction details. 

Maintain Security 37: Manages the list of 
compromised money modules, applies for 
certificates, synchronizes the clocks, and 
manages the creation of new digital keys. 

Note Directory 39: Keeps track of the 
location, value and identification of notes 
11 by monetary unit, summary totals are 
also maintained. 

Notes 40: Manages storage for the 
electronic notes 11 of exchange, and 
creates the transfers for the notes 11. 

Packet Manager 41: Manages the assembly 
and dissembly of a packet to be transferred 
to a different money module. 

Verifier 42: Verifies that a received 
packet contains valid electronic notes 11. 

Clock/Timer 43: Controls transaction 
timeout, expiration of the validity of the 
electronic notes 11, expiration of the 
certificate, and general clock functions. 

- Cryptography 

(i) Public key 44: used for signatures to 

sign and validate notes 11 and to set 
up a secure transaction session. 

(ii) Symmetric key 45: Controls the 

security of a transaction session. 

(iii) Random number generator 46: Generates 

random like numbers for new 
cryptographic keys. 



Some of the distinguishing applications are the 



PCT/US92/09732 



To Bank 47 and To Transaction 49 applications. The Tp. 
Bank application 47 provides the interfacing means whereby 
the Teller money module 5 can perform exchanges of data 
for inquiries and account postings with the on-line 
systems of a bank. This application is also utilized for 
crosschecking the customer's account number with the 
accounts and type of transaction being requested. 

The T" Transaction application 49 performs 
deposits, withdrawals and payments to loans. This 
application operates whenever a Teller money module 5 is 
transacting with a subscriber's Transaction money module 
4. 

As mentioned above, a Teller money module 5 may 
be associated with an Issuing Bank 1 or a Correspondent 
Bank 2. When Teller money module 5 is associated with a 
Correspondent Bank 2, it is utilized for intermediating 
deposits, withdrawals, and payments to loan accounts 
between a Transaction money module 4 , the Correspondent 
Bank's 2 on-line systems, and an Teller money module 5 at 
an Issuing Bank 1. 

When operating in an Issuing Bank 1 mode, the 
Teller money module 5 is used for intermediating deposits, 
withdrawals, and payments to loan accounts between other 
money modules and the Issuing Bank's 1 on-line systems. 
Additionally, when the Teller money module 5 is performing 
in an Issuing Bank 1 mode, a To Money Generator 
application 48 may be employed when requesting new notes 
XI. 

Basically, the To Money Generator application 48 
performs banking functions dealing with requests for 
electronic notes 11. It interfaces an Issuing Bank's 1 
Teller money module 5 to a Money Generator Module 6. 

All of the other elements performed in an 
Issuing Bank's 1 Teller money module 5 are essentially 
identical to the similarly named components and 
application functions described above. 
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Money Generator Module 

Figure 6 is a block diagram illustrating the 
application functions of a Money Generator module 6. 
Money Generator modules 6 provide the mechanism that 
Issuing Banks 1 utilize to issue electronic money. A 
Money Generator module 6 is also encased in a tamper- 
resistant package for the same security reasons stated 
above for other money modules. 

A Money Generator module 6 generates the 
electronic money (in the form of electronic notes 11, to 
be described in further detail below) , and distributes 
them to other money modules through the Teller money 
module 5 of an Issuing Bank I. The Money Generator module 
6 includes a unique application not present in other money 
modules for responding to requests for electronic money. 
This is the Money Creator application 50. 

The Money Creator application 50 creates and 
formats the electronic objects representing value - either 
currency backed by demand deposits, or credit 
authorizations - and digitally signs these "electronic 
notes 11" using public key cryptography in conjunction 
with its secret key, so that it may be sent to an Issuing 
Bank's Teller money module 5. 

Notably, in a Money Generator module 6 the To 
Bank application 47 notifies the bank systems of any 
irregularities, off-loads transaction records in the Tran 
Log to the Transaction Reconciliation System 22 and 
transfers electronic notes 11 to the Money Issued 
Reconciliation System 23. All of the other applications 
of the Money Generator module 6 are identical to the 
similarly named applications of the money modules 
described above. 



The Network 

According to one embodiment of the invention, 
the individual components of the present invention may 
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„ communicate over a Network 25, as shown in Figure 7. The 
Network 25 will link together the Issuing Banks 1, 
Correspondent Banks 2, the Clearing Bank 3 and the 
Certification Agency 8. 

Transaction money modules 4 may be coupled to 
the Network 25 over the telephone exchange or via special 
5 terminal facilities at bank locations (e.g. , additional 
contactless or cable connections at an ATM booth) . A 
communication layer will carry transaction requests (e.g., 
deposits, withdrawals) , packets of notes XI and new 
certificates securely across the Network 25. In the 
10 preferred embodiment, the Network 25 will also provide 
directories of financial services, and update the money 
module clocks and the bad money module list of all money 
modules. 

As will be understood, the Network 25 may use 

15 well known data link or communications systems and 

techniques that utilize, for example, telephone lines, 
fiber-optic land lines, and satellites, and that include 
connective, timing and control software and circuitry for 
allowing access and transmitting digital information. The 

20 Network 25 may use commercially available protocols and 
operating techniques such as those set forth by the 
International Standards Organization ("ISO") for Open 
Systems Interconnect network standards. It is important 
to note that the particular design of the Network 25 is 

25 not critical and suitable technologies for accomplishing 
the foregoing data communications functions may be used. 

Each entity (Banks 1 and 2, certifying Agency 
28, or Clearing Bank 3) is also assumed to have an 
individual local network 16, 17 , 18 and a gateway to the 

30 larger system Network 25. The larger Network 25 will 

provide directory services for the routing of messages to 
connect to the appropriate local network 16, 17, 18. The 
local network 16, 17, 18 has the responsibility of routing 
messages to the correct money module or Security Server 
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,27. A Security Server 27 is associated with each 
participating bank and the certification Agency 28, and is 
used for implementing the security of the system. 

Figure 7 illustrates the preferred embodiment of 
the Network 25 generally, indicating that money modules of 
any participating bank may be intercoupled to the money 
modules of other banks and financial institutions, or 
another subscriber's Transaction money module 4 via a 
communications link directly connected into switching and 
processing centers and alternatively connected to a local 
network 16, 17, 18 at each entity. 

A money module need only identify the local 
network 16, 17, 18 destination (typically a bank 
subnetwork) for the transmission of most messages. The 
local network 16, 17, 18 will route the message to an 
appropriate money module for establishing a session. Once 
a session is established, the Network 25 directs all 
messages between the two money modules. The Network 25 
also controls messages between money modules and Security 
servers 27. 

Transaction money modules 4 may communicate over 
the Network 25 for deposits, withdrawals, payments to loan 
accounts, updates or inquiries. The Teller 5 and Money 
Generator modules 6 will sign on the Network 25 
periodically to update security information. The sign-on 
will be initiated by the money module Session Manager 31, 
or by the bank Security Server 27 if recertif ication is 
required or if there are changes to the bad money module 
list. 

A bank services directory may be available to 
the money modules primarily for updating the electronic 
notes 11 and performing foreign exchange. A list of 
participating banks for either service will be available 
from the Network 25. 

In the preferred embodiment, the Network 25 will 
provide time services to the individual components of the 
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present invention. Transaction 4, Teller 5 and Money 
Generator modules 6 and Security Server 27 clocks may be 
updated from a Network Server 26 in the Network 25 every 
time that the respective money module accesses the Network 
25. 

network Servers 26 may provide the money module 
' services described below, and gateway services to the 
local networks 16, 17, 18. The application functions of 
the preferred embodiment of the Network Server 26 are 
shown in the block diagram of Figure 8. The following 
application functions are contemplated for the Network 
1 sever 26 t 

(1) External Interface 56 - a communications 
layer which interfaces to the Network 25; 
and 

(2) communication Session Manager 57 - manages 

* a communication session between money 
modules, and between a money module and the 
Security Server 27. 

Application Services are provided by: 

(3) Manage Network Sign-on 58 - controls the 
' money module Network sign-on process; 

(4) Synchronized Time/Date 59 - keeps money 
module Clock/Timer 43 services synchronized 
to a system time; 

(5) Route Message 60 - directory services for 

* routing messages, controlling message 
routing during sign-on and during a money 
module session; and 

(6) Direct to Bank Services 61 - provides 
information on services provided by 

* participating banks. 

As will be appreciated by one skilled in the 
art, switching and processing centers that are known in 
the industry may be used to enable the networking 
cooperation between a financial institution and any other 
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» that is coupled to the same centers. 

Electronic notes 
We turn now to a further description of the 
elements of the electronic notes 11 themselves. 

j An electronic currency note 11 representing 

value is essentially an electronic object created from a 
transaction request (deposit or withdrawal) which is 
backed by demand deposits at an Issuing Bank 1. At 
various times and in various points of the system, the 

0 notes may appear in electrical or magnetic forms or as 
electromagnetic radiation. These notes XI may be 
transferred over several transactions just like paper 
money, with the additional property of fungibility that 
allows the electronic notes 11 to be commuted and 

^ transferred in amounts less than or equal to the value of 
the note 11. 

Notes 11 may be split by appending a transfer 
record to. the note 11 and signing the note 11 using the 
private cryptographic key of the money module transferring 

Q the note 11. Electronic credit notes 11, however, can 
only be transferred once in the preferred embodiment, 
because it is anticipated that its receiver must deposit 
the credit note 11 so that the loan may be realized. 

Credit notes 11, unlike currency notes 11 are 

^ drawn on a subscriber* s loan account. Each credit note 11 
carries the account number it is drawn on. The account 
may be a revolving credit or credit line on which the note 
11 is drawn, operating much in the same way that a check 
or a credit card account works in today's banking 

Q industry. Credit notes 11 can represent a part of or all 
of the credit line of the account. 

In the preferred embodiment, the credit notes 11 
can only be transferred to another Transaction money 
module 4 by the owner of the account, and the receiver of 
a credit note 11 can only deposit it into his or her 
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. account as currency. From there, the credit note 11 is 
cleared with the currency at the Clearing Bank 3. The 
subscriber's bank recognizes the loan upon receipt of the 
cleared credit note 11. 

When credit notes 11 are withdrawn, they do not 
trigger any accounting transactions in the preferred 
embodiment. Current credit line processing may to be 
modified to keep track of the amount of the credit line in 
the subscriber's Transaction money module 4. Whenever the 
subscriber communicates with the Issuing Bank 1 
in maintaining the credit line, the amount of the credit line 
1 in the Transaction money module 4 is removed and replaced 
based on any adjustments to the credit line in the banking 
system 20. Total credit notes 11 plus outstanding loans 
must be less than or equal to the total amount of the 

T _ credit line. 

Electronic notes 11 are comprised of three 
collections of data fields, namely a Body group, a 
Transfer group, and a Signatures and Certificate group. 
The Body group of data fields includes the following 

2Q information: 





(1) 


the type of electronic note 11, i.e., 
whether it is a currency note 11 or a 
credit note 11; 




(2) 


the Issuing Bank's 1 identifier; 


25 


(3) 


the monetary unit identifier; 




(4) 


a Note identifier; 




(5) 


its date-of-issue ; 




(6) 


its date-of-expiration; 


30 


(7) 


the subscriber's account number (used only 
for credit notes 11 > ; 




(8) 


the amount or value of the note 11; and 




(9) 


the Money Generator module 6 identifier. 


35 


The 


Transfer group of data fields includes: 
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(1) a total of the number of times that the 
electronic note 11 was transferred; 
(provided for currency notes 11 only) 

(2) a list of transfer records that indicate to 
whom the apportioned note 11 was 
transferred from, the date-of -transfer, the 
amount transferred and the identification 
number of the receiver. 

The Signature and Certificates group of data 



(1) the digital signature of the Money 
Generator module 6; 

(2) the Money Generator module 6 certificate; 

(3) a list of payers which contains each 
payor's signature and certificate; 

(4) the digital signature of the payor; and 

(5) the payor money module certificate. 

The notes 11, transfer records, the signature 



and the certificate of the chain of the transferred 
payments constitute the electronic note 11 sent; the 

20 remaining amount of the note 11 is recorded in the Note 
Directory 39 of the money module in which it is stored. 

It is important to note that the authenticity of 
an electronic note 11 is determined by the validity of the 
digital signature of the Money Generator module 6, and the 

25 validity of the signatures of past payors (if present) . 
Any inconsistencies in this information will case the 
transfer of any electronic notes 11 to be aborted. 

It is also important to note that as a security 
measure, notes 11 will be valid for a limited time, up to 

30 its expiration date. An expired note 11 cannot be 
transferred, it must be updated by transacting with a 
participating bank. To this end, whenever a Transaction 
money module 4 performs any transaction with a Teller 
money module 5, all of the electronic notes 11 stored in a 

35 Transaction money module 4 will be transferred to the 



fields includes: 
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Teller money module 5 so that notes 11 may be replaced 
with updated ones before they expire. This security 
procedure also helps to keep offending notes 11 from being 
circulated broadly. 

As will be understood, every time that a note 11 
is transferred to another money module, a digitally signed 
transfer record indicating from whom it is transferred is 
appended. Thus, the recipient of an electronic note 11 
will also receive a record of all of the past holders of 
the note 11. 

For example, a $50 electronic note 11 may be 
generated, and withdrawn by a Transaction money module 4. 
Assuming it is transferred to other money modules in $10, 
$10, and $30 denominations, the recipient money modules 
will receive the note 11 with the transfer record 
identifying the first Transaction money module 4. When a 
recipient of the $10 note 11 transfers $5 of it to a third 
party, the third party receives the note 11 along with the 
record indicating the previous two holders. Assuming this 
$5 note 11 is then deposited, a record of it will be 
matched with other segments of the original $50 note 11 
that find there way back into the banking system by the 
clearing and reconciliation processes of the present 
embodiment. 

Only the receiver of the transferred note 11 can 
either deposit the note 11 or use it in payment. The 
Verifier 42 application of a money module is used to check 
the signature of each transfer, to determine if the note 
11 is valid and to verify the identifier in the last 
transferor as the current holder of the note 11. This 
thwarts the new holder of a note 11 from trying to use a 
value greater than that which was transferred. It also 
inhibits copying notes 11 for use in another money module 
since the identifiers will not match. 

As can be appreciated, a subscriber may be able 
to access certain information about the electronic notes 
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, 11 stored within the Transaction money module 4. 

In particular, the subscriber may be able to 
select information on the total amount of the electronic 
notes 11 stored, the monetary unit of the notes 11, the 
type of electronic notes 11, i.e., currency or credit, and 

, the denomination of each note 11. 

System Security 

The security of the system is maintained by the 
participating banks and the Certification Agency 28, which 
creates and distributes money module certificates. A 
certificate of a money module is actually a the money 
module's identifier, its public key, a digital signature 
of a money module's identifier and public key 
certif icatory key (described below) , and the version of 
the certificatory key. The certificate is unique in that 
it is associated with only one particular money module. 

The Certification Agency 28 provides a secure 
means for money modules to validate each other prior to 
transacting, first by controlling the money module 
certificate process and second, by distributing a list of 
bad money module identifiers. 

In the preferree embodiment, the money module 
certificate will be initially loaded into the money module 
by the Certification Agency 28. The Certification Agency 
28 generates the certificate for each money module using a 
certificatory key (a private key of the Certificate Agency 
28) . It may be changed periodically and distributed under 
version control processes that are commonly used in the 
industry. As will be appreciated, every money module will 
store several versions of the certificatory key in order 
to verify certificates created by an older key. Because 
it is anticipated that certificates will expire over time, 
it is expected that only a few versions need be kept. 

A certificate will only be valid for a limited 
period of time after its creation. Upon expiration of the 
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0 certificate, the money module will not be allowed to 
° transact with other money modules. Any money modules 
discovered to have been tampered with will be limited in 
the amount of damage that they can do to the system since 
their certificate will not be updated. 

To block offending modules from transacting it 
5 is also desirable to have legitimate money modules receive 
the latest list of offending money modules soon after the 
list is updated. Naturally, this requires that 
Transaction money modules 4 access the Certification 
Agency 28 on a periodic basis to obtain the latest list. 

10 Placing a time limit on the Transaction money module's 4 
ability to transact (in addition to the time limit placed 
on electronic notes 11) will force subscribers to access 
the Certification Agency 28 through the Network 25 on a 
periodic basis to receive the latest bad money module list 

15 along with the a new certificate. Advantageously, the 
period of the certificate validity can be closely 
monitored and adjusted according to security needs. 

The certification Agency 28 distributes its 
updated certificatory key and money module certificates 

20 on-line through the Security Server 27 (see Figure 9) . An 
Important component of the system's security is provided 
by Security Servers 27 at the participating banks and 
Security Servers 27 at the Certification Agency 28. 

Referring now to Figure 10, a block diagram of a 

25 preferred embodiment of the Security Server 27 is shown. 
It is contemplated that the security Server 27 at the 
certification Agency 28 or on a bank's local network 18 
will contain the following application functions: 

(1) External Interface 54 - a communications 
30 layer for connecting to a bank's local 

network 18 or the Certification Agency's 
local network 17; 

(2) Session Manager 55 - controls the security 
aspects of a transaction session; 

35 
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Create Certificate 50 - certifies a 
certificate for any of the money modules; 
Create Account Profile Si - certifies and 
signs a bank account profile (described in 
detail hereinafter) that allows a 
Transaction money module 4 to access the 
subscriber's different bank accounts; 
Distribute Certification Keys 52 - 
distributes the Certification Agency's 28 
list of valid public keys to the money 
modules ; 

Bad Money Module Control 53 - controls and 
distributes the list of bad money modules; 
and 

Services - identical to the cryptographic 
functions 44, 45, 46 in the money modules 
described above 
Since certificates will expire over time, money 
modules will be required to apply for new certificates 
periodically. In order to receive a new certificate, the 
money module creates a new public key and private key. 
The new public key, the money module identifier and the 
old certificate are presented to the Certification Agency 
28 after being digitally signed using the old private key. 

The Certification Agency 28 checks the signature 
and if it is valid, signs the new public key and 
identifier and sends the certificate to the money module 
with a future expiration date. The Certification Agency's 
. 28 Security Server 27 also distributes a list of bad money 
modules via the Network 25. Initially, each participating 
bank's Security Server 27 reports the identifiers of money 
modules which hold notes 11 invalidly or that are 
counterfeit. Those identifiers are passed through the 
Security Servers 27 and are compiled by the Certification 
Agency 28. 

All such identifiers are distributed to the 



(3) 
(4) 
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-Teller and Money Generator modules 5, 6 respectively. A 
money module will not transact with another money module 
found on the list of bad money modules. Optionally, only 
those money modules which have demonstrated a flagrant 
breach of security will be distributed to Transaction 
5 money modules 4. 

If a Transaction money module 4 is lost or 
stolen, the subscriber would report it to his/her bank or 
to the certification Agency 2s so that the money module 
identifier may be placed on the bad money module list to 
10 inhibit any further transactions. 

While the security of the system is provided by 
being able to block a money module from transacting, 
system security is also maintained by providing the 
expiration date on the electronic notes 11 in addition to 
15 the money module certificates. 

1 As mentioned previously, a note 11 will be valid 

only for a limited time period after it is generated. Its 
date-of-expiration is a security parameter which may also 
be monitored and varied as needed. The period of validity 

20 of a note 11 can be varied by the value of the note 11. 
Preferably, a large note 11 will expire in a shorter time 
period than a smaller one. For example, a $1,000,000 note 
may be set to expire five days after the date of its 
creation since it would provide a significant incentive to 

25 counterfeit, while a §50 note 11 may be set to expire 
after a month from the date of its creation. 

A Transaction money module 4 will not accept 
expired notes 11, but can deposit or exchange the notes 11 
it may contain for new notes 11. The expiration dates are 

30 checked by the Verifier 42 and Clock/Timer 43 applications 
in a money module before any electronic note 11 is 
transferred. Separately, it is also anticipated that if 
the money module loses power then it will not be able to 
pay or exchange notes 11 after power has been regained 
until it has communicated again with the Network 25 and 
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o had its security parameters updated. 

As stated above, a subscriber will typically 
obtain a Transaction money module 4 already loaded with a 
certificate. Securing the Transaction money module 4 
itself to a subscriber may be accomplished by assigning it 
5 a unique PIN, biometrics or other personal secret 
characteristics. 

Before any personalization of the money module 4 
may proceed, the Transaction money module 4 checks if 
there is a bank account already stored in the To Teller 34 

10 application or if the Notes 40 application contains any 
electronic notes 11. In either of these cases, the 
Transaction money module 4 will inhibit the subscriber 
from securing the module with new secret information. 

If the Transaction money module 4 has no account 
numbers or no stored notes 11, then the subscriber can 
secure it by either entering a PIN, which is reverified by 
the Transaction money module 4, or by executing a process 
in which the Transaction money module 4 learns the 
subscriber's biometrics. Once the personalization has 

2Q been completed, subscriber access to the Transaction money 
module 4 requires the successful completion of a sign-on 
in which the secret information is presented to the 
Transaction money module 4. If the subscriber can sign on 
to the Transaction money module 4, then he/she will be 

25 permitted to change PIN's or reintroduce biometrics. 

In the situation where a subscriber has 
forgotten his/her PIN or had an incident which has 
affected his/her biometric reading, then the subscriber 
may take his/her Transaction money module 4 to a 

3Q participating bank. A special transaction may be executed 
which deposits any electronic notes 11 in a holding 
account and destroys the stored bank account numbers. The 
subscriber can now enter new secret sign-on numbers and 
characteristics. Any electronic notes 11 that were 

->c removed are returned to the Transaction money module 4 and 
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- the banlc account numbers may then be recreated (see Bank 
Access below). 

It should be noted that it is not a requirement 
for a subscriber to identify himself to the system when he 
takes possession of a Transaction money module 4. Though 
5 the identity of the money module is contained in every 
transaction, the holder of a Transaction money module 4 
can be kept secret. If the relationship is revealed then 
one could trace all of the transactions of a subscriber 
for the period that the relationship can be corroborated. 

10 The only time a subscriber must reveal his identity is if 
he/she links the money module to a bank account or wishes 
to redeem money lost. 

If the subscriber chooses to use the Transaction 
money module 4 only for payments and foreign exchange then 

15 he/she can keep the relationship secret. As may be 

appreciated, the subscriber may also acquire a plurality 
of Transaction money modules 4 and, for example, link one 
to bank accounts and maintain the others for anonymous 
payments. The other Transaction money modules 4 may be 

2£) loaded with notes XI by exchanges with other money modules 
or by exchanging for cash notes 11. 

p op l a r.Prn P _nt of Money Module Value 

If a Transaction money module 4 malfunctions or 
25 is lost or stolen, it may be possible for the subscriber 
to recoup the value that was stored in the money module at 
the time of the incident. This would necessitate that the 
subscriber relinquish the option of anonymity for that 
money module, since upon making a claim for the lost 
30 money, he/she would have to verify that he/she is the 
owner of the Transaction money module 4. 

To provide for the replacement of electronic 
notes 11, the subscriber may first link his/her 
Transaction money module 4 to a bank account or register 
35 ownership of the Transaction money module 4 with the 
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Certification Agency 28. After every transaction 
involving the transfer of electronic notes 11, the 
subscriber could save the Tran Log, which identifies the 
counterparty money module identifier and the note 
identifier, to inexpensive, non-volatile storage which is 
removable from the host computing environment. This log 
may be presented by the subscriber when making a claim to 
replace value. The log may then be compared to 
reconciliation files to determine the true value of the 
lost electronic money. 

An alternative to this procedure would be to 
refresh the money in the Transaction money module 4 
frequently. This would mean that the notes 11 in the 
Transaction money module 4 would be represented by 
transaction records at the Issuing Banks 1. The existence 
of the notes 11 could be verified by scanning these files. 

A third alternative would allow the system to 
capture a money module's Tran Log when money is refreshed. 
These records would be copied and routed to Issuing Banks 
1 for storage on their transaction histories. The 
existence of the notes 11 could then be verified as in the 
previous alternative. 



Bank Access 
According to one aspect of the invention, a 
customer's Transaction money module 4 may access his/her 
accounts for deposits, withdrawals, transfers, etc., at 
any bank participating in the system and in particular any 
bank holding an account with the subscriber. For 
instance, a typical subscriber may have a savings account 
and a checking account at one of the participating banks, 
while maintaining a so-called money market account at a 
separate financial institution, and perhaps a credit-line 
account at a third participating bank. It is anticipated 
that a subscriber's Transaction money module 4 will access 
his/her accounts for deposits, withdrawals, loan payments 
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, and inquiries at any bank or financial institution which 
can be accessed through the Network 25. 

If a subscriber has multiple accounts, the 
subscriber's account relationships with a bank will be 
stored in an account profile in the To Teller 34 

. application of the Transaction money module 4. The 
multiple accounts can be linked together by the personal 
account number ("PAN") associated with the individual 
subscriber. 

The account profile may be created either in 
person, under the control of a bank subscriber service 
representative at a branch, or over the telephone 
utilizing a special dialogue. For example, the subscriber 
may identify himself by his PAN and PIN. He may then 
enter each account number he wishes to access from his 
Transaction money module 4. The account numbers may be 
verified in the bank's account reference files. A cross- 
reference of accounts to Transaction money modules 4 may 
be maintained by each bank if they so choose. 

The composition of an exemplary account profile 

may be: 

(1) Bank Identifier — one for each bank; 

(2) Account Numbers; 

(3) Account Types — e.g., checking, savings, 
credit; and 

(4) Security Server 1 s 27 signature on the list 
of accounts. 

It will be understood that the list of account 
numbers will be digitally signed by the bank Security 
Server 27. As a further security measure the account 
profile may be re-signed with an updated public key on a 
periodic basis. The fundamental access security is 
provided by the digital signature of the bank's Security 
Server 27. 



35 
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Banking System ^Accounting Architecture^ 
It is an notable feature of the preferred 
embodiment, that the method of the system can parallel the 
existing and varying types of accounting methods that 
exist today. The system of the preferred embodiment 
5 follows the various types of accounting methods practiced 
presently in various banks. However, it is important to 
note that unlike the present banking system, in the 
preferred embodiment of the invention, economic value is 
created on demand. Thus, there is no inventory of cash or 
10 checks involved; electronic currency from demand deposits 
an electronic credit are created on a real-time basis. 
This elimination of a paper inventory by using an 
electronic media of exchange requires certain supplements 
to the commonly practiced accounting techniques to provide 
15 the real-time accounting needed. 

Accordingly, the embodiment of the present 
invention provides an accounting structure to supplement 
those used in the present banking systems 20. The 
improved accounting arrangement may be utilized to monitor 
2o the electronic money and each bank's obligation when a 

financial transaction between a Transaction money module 4 
and a Teller money module 5 occurs, or when a Clearing 
Bank 3 performs any clearing processes. 

When electronic notes ll are transferred to or 
25 from a Teller money module 5, in most cases accounting 
transactions affecting the records of the banking system 
20 are created. Conversely, transfers between Transaction 
money modules 4 do not involve any formal accounting 
procedures — they involve only the transfer of electronic 
30 notes 11. 

In the system being described, it is anticipated 
that the following arrangements of accounts are to be 
utilized for each type of bank, categorized under each 
monetary unit: 
35 At an Issuing Bank 1- 
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fl) Money Issued Account: A liability account 
which reflects the money issued but not 
cleared. 

(2) Money Due Account: An asset account 
reflecting the money deposited to the 
bank's accounts. 

f3) Deposited at Clearing Bank Account: An 

asset account reflecting the balance of a 
clearing account at a Clearing Bank 3. 

(4) Correspondent Bank Money Account: A 

liability account owned by a correspondent 
Bank 2 which is drawn upon by the 
correspondent Bank 2 to dispense electronic 



(5) Money In Transit Account: A 2er °-^ la £5; e eh 
liability account owned by each bank, which 
is used to temporarily maintain electronic 
money during a financial transaction. 

(6) Foreign Exchange Account: A zero-balance 
liability account owned by each bank, which 
is used to handle multiple currency 
exchanges . 

At a Correspondent Bank 2 - 

(1) Deposited at issuing Bank Account: An 
asset account reflecting the balance of the 
Correspondent Bank 2 account at the Issuing 
Bank 1. 

(2) Money Due Account: An asset 
account reflecting the money 
deposited to the bank's 
accounts. 

(3) Foreign Exchange Account; A zero-balance 
liability account owned by each bank, which 
is used to handle multiple currency 
exchanges. 

(4) Money In Transit Account: A zero-balance 
liability account owned by each bank, which 
is used to temporarily maintain electronic 
money during a financial transaction. 

At the Clearing Bank 3: 

(1) Issuing Bank Clearing Account: A liability 
account to net the amount of money cleared 
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for an issuing Bank 1. 

The accounts, with their corresponding symbols, 
are summarized below: 



Type of Bank Account Name 



Type 



Symbol 





Issuing 


Money Issued 


Liability 


Issuing 


MI 






Money Due 


Asset 


Issuing 


MD 






Deposited at 


Asset 


Issuing 


DC 


10 




Clearing Bank 












Correspondent 












Bank Money 


Liability 


Correspondent 


CM 






Money In Transit 


Liability 


Issuing 


IT 






Foreign Exchange 


Liability 


Issuing 


FX 


15 


Correspondent 


Deposited at 


Asset 


Correspondent 


DI 






Issuing Bank 












Money Due 


Asset 


Correspondent 


MD 






Money In Transit 


Liability 


Correspondent 


IT 








Liability 


Correspondent 


FX 


20 


Clearing 


Clearing Account 


Liability 


Issuing 


CA 



Transaction processing, for a transaction such 
as a request for a withdrawal from savings, selects 
accounting processes so that the appropriate accounts may 
be credited and debited accordingly. It is anticipated 
that the accounting processes will be using software 
programs and methods that are well known in the art and 
presently available; inasmuch as any of the programs and 
methods currently practiced and known for providing the 
foregoing accounting procedures would be suitable for use 
in the invention. To better understand the accounting 
processes of the invention, several examples of typical 
transactions and their associated accounting steps will be 
described. 
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Accordingly, Figures 11-24 illustrate the 
accounting transactions for deposits, withdrawals, foreign 
exchanges, receipt of cleared money, electronic money/cash 
exchanges, and note 11 updates. Figures 11-14 and 19-22 
also illustrate the accounting flows when a Transaction 
5 money module 4 contains notes 11 that are not involved in 
the particular transaction that is occurring. The notes 
11 that are not part of the transaction are replaced with 
updated notes as discussed in the security procedures 
described above. For example, when a subscriber deposits 

10 less electronic money than is stored in his/her 
Transaction Money Module 4, leaving a balance, the 
electronic notes 11 representing the balance are then 
replaced with electronic notes 11 containing the most up- 
to-date certificates. This latter case is indicated in 

15 the parenthetical on Figures 20-23 and 28-31. 

In an example of the accounting arrangements 
according to the invention (illustrated by Figure 11) , if 
a subscriber were to deposit $50.00 out of $100.00 of 
electronic money contained in his/her Transaction money 

20 modules 4 at a Correspondent Bank's Teller money module 5 
(Step 1) , the entire $100 of electronic money would be 
extracted of which $50.00 would first be credited to 
his/her customer account (herein denoted by "A") , the 
remaining $50.00 would be credited to the Correspondent 

25 Bank's In-Transit account, and $100 would be debited to 
the Money Due account at the Correspondent Bank 2. See 
"it" and "MD" in Figure 11. 

After the $100 of electronic notes 11 is 
removed, the notes 11 are deposited from the Correspondent 

30 Teller money module 5 to the Teller money module 5 of an 
Issuing Bank 1 (Step 2) . In accomplishing this transfer, 
the Money Due account at the Correspondent Bank 2 is 
credited $100 while its Deposited at Issuing Bank account 
is debited by $100; the Issuing Bank 1 credits its 

35 correspondent Bank Money account by $100 and debits its 
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o Money Due account by $100. 

In Step 3, the updated notes 11 are requested. 
Thus, the Correspondent Bank 2 requests from the Issuing 
Bank 1 the withdrawal of $50 of electronic money 
containing the most recent certificates from its Money 

5 Generator module 6. To support this request, $50 is 

credited to the Deposited at Issuing Bank account and $50 
is debited from its Money In Transit account. The issuing 
Bank 1 then debits $50 from its Correspondent Bank Money 
account and credits $50 to its Money Issued account. 

Q To complete the transaction, the $50 is then 

transferred from the Money Generator module 6 to the 
Correspondent Bank's 2 Teller money module 5 through the 
Issuing Bank's 1 Teller money module 5, and finally to the 
Transaction money module 4 (Steps 4-6) . The net result of 

5 all of these transactions is that $50 remains deposited in 
the subscriber's account and $50 of newly issued 
electronic notes 11 are now stored in the Transaction 
money module 4 of the subscriber. 

Alternatively, if a subscriber begins with $50 

Q in his/her Transaction money module 4 and deposits all of 
it, the customer account would be credited $50 and the 
Money Due account would be debited by $50 (Step 1 of 
Figure 11; parenthetical entries). 

When there are only $50 of electronic notes 11 

. that are removed, the Correspondent Bank 2 credits the 
Money Due account $50 and the Deposited at Issuing Bank 
account is debited $50 (Step 2, parenthetical entries) . 
This money is then deposited at the Issuing Bank 1 for 
later clearing, wherein the Correspondent Bank Money 

} account is credited by $50 and the Money Due account is 
debited by $50. Because no updated electronic notes 11 
need be returned in this situation, the deposit and its 
corresponding accounting is completed at step 2. 

The accounting processes of an electronic money 
deposit at an Issuing Bank 1 instead of a Correspondent 
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o Bank involve fewer operational steps, which are 
illustrated in Figure 12. using the same dollar amounts 
as in the previous exemplary transaction, when $50 of $100 
in electronic money stored in the Transaction money module 
4 are deposited directly to an Issuing Teller money module 

j (Step 1) , $50 would be credited to the customers account 
(A) . Fifty dollars would simultaneously be credited to 
the Money In Transit account, and $100 would be debited to 
the Money Due account at the issuing Bank 1. 

Since the entire $100 stored in the Transaction 

) money module 4 is removed and transferred to the Issuing 
Bank's Teller money module 5, it is necessary to return 
$50 of updated notes to the Transaction money module 4. 
Accordingly, as shown in Step 2 the Teller money module 5 
requests $50 from its Money Generator module 6, debiting 
its Money In Transit account by $50 and crediting its 
Money Issued account by $50. 

In response, $50 is created by the Money 
Generator module 6 and transferred to the Teller money 
module 5, which in turn transfers this electronic money to 
the Transaction money module 4 (Step 3-4). 

When only $50 is stored in the Transaction money 
module 4 and all of it is deposited, the customer's 
account (A) is credited $50, the Money Due account is 
credited $50, and that is the end of it. See 
parenthetical entries in Step 2 in Figure 12. 

In the case of a withdrawal from a Correspondent 
Bank (see Figure 13) , a withdrawal request of $100 by a 
subscriber using a Transaction money module 4 at a 
Correspondent Bank 2 will cause the subscriber's account 
(A) to be debited by $100 and the Correspondent Bank's 2 
Money In Transit account to be credited by $100 (Step 1) . 
The request for the $100 withdrawal is forwarded to the 
Issuing Bank 1 from the Correspondent Bank 2, and the 
Correspondent Bank's Deposited at Issuing Bank account is 
credited by $100 while its Money In Transit account is 
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u debited by §100 (Step 3) . 

Next, the request for $100 is forwarded by the 
Issuing Bank's 1 Teller money module 5 to the Money 
Generator module 6. Accordingly, the Correspondent Bank 
Money account gets a §100 debit while the Money Issued 
5 account gets a §100 credit (Step 4) . 

The Money Generator module 6 then creates the 
§100 of electronic notes 11, and transfers it to the 
Transaction money module 4 via the Issuing Bank's 1 Teller 
money module 5 and the Correspondent Bank's 2 Teller money 
10 module S (Steps 5-6) . 

When, e.g., the subscriber makes the §100 
withdrawal request with a Transaction Money Module 4 that 
contains §50 of electronic notes 11, the notes 11 are 
removed and now the Money Due account is debited §50, the 
15 subscriber's account is still debited §100, and the Money 
In Transit account is credited §150 (parenthetical 
entries, Step 1) . 

The §50 is then deposited to an Issuing Bank 1, 
causing the Money Due account to be credited §50 and the 
20 Deposited at Issuing Bank account to be debited by §50. 
At the Issuing Bank 1, the Correspondent Bank Money 
account is credited §50 while the Money Due account is 
debited §50 (Step 2, parenthetical entries). 

Because §50 of notes 11 have been removed, the 
25 withdrawal request in Step 3 must be for §150. This 

request causes the Deposited at Issuing Bank account to be 
credited by §150 and the Money In Transit account to be 
debited by §150 (Step 3 parenthetical entries) . 

At the Issuing Bank, §150 is requested from the 
30 Money Generator Module 6 and the Correspondent Bank Money 
account gets a §150 debit while the Money Issued account 
gets a §150 credit (Step 4 parenthetical entries) . As 
above, the money generated by the Money Generator Module 6 
(§150) gets conveyed to the Transaction money module 4 via 
35 the Issuing Bank 1 and Correspondent Bank 2 Teller money 
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„ modules 5 (Steps 5-6, parenthetical entries). 

A withdrawal from an Issuing Bank 1 involves 
fewer accounting procedures. Referring now to Figure 14, 
a withdrawal request by a Transaction money module 4 from 
an issuing Bank 1, Step 1 will cause the Issuing Bank 1 
Teller money module 5 to debit the subscriber's account 
(A) by $100 and credit its Money Issuing account by $100 
(Step 1-2) . 

A request for an updated $100 is then made by 
the Issuing Bank's 1 Teller money module 5 to the Money 
Generator module 6, which upon its creation will return 
10 $100 to the Issuing Bank's Teller money module 5 (Step 3). 
In completing the transaction, the Issuing Bank's 1 Teller 
money module 5 simply transfers this $100 containing the 
most recent certificate to the Transaction money module 4 
(Step 4). 

Alternatively, when the Transaction money module 
contains $50 at the time of the $100 withdrawal, 
(parenthetical entries) the $50 will be removed, the 
Issuing Bank's Money In Transit account will be credited 
$50 and the Money Due account will be debited $50 (Step 

20 i). 

The Issuing Bank 1 must now request $150 from 
the Money Generator module 6. Naturally, the customer's 
account is debited $100. The Money Issued account is 
credited by $150 when the new notes 11 are created, and 

25 the Money In Transit account is debited $50 (Step 2) . 
From there, $150 is returned to the Transaction money 
module 4 via the Issuing Bank's 1 Teller money module 5 
(Steps 3-4). 

Figure 15 illustrates the case of a foreign 

30 exchange with an Issuing Bank 1. In this example, a 
subscriber wishes to exchange $100 of electronic money 
stored in his/her Transaction money module 4 for £60 of 
British currency. The deposit at the Issuing Bank's 1 
Teller money module 5 will cause the Issuing Bank's 1 
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„ Foreign Exchange account to be credited by £60, while its 
Money Due account would be debited by $100 (Step 1) . 
Here, the $100 is transferred from the Transaction money 
module 4 to the Teller money module 5, which then requests 
that an electronic note 11 representing £60 be created by 

5 the Money Generator module 6 (Step 2). 

At the Issuing Bank 1, the foreign exchange 
account is now debited by £60 while the Money Issued 
account is credited by £60. The £60 electronic note 11 
created by the Money Generator module 6 is transferred to 

j the Teller money module 5, which now stores both the $100 
and the £60 (Step 3) . The £60 is then transferred from 
the Teller money module 5 to the Transaction money module 
4 resulting in a net balance of £60 in the Transaction 
money module 4 and $100 remaining in the Teller money 
module 5, completing the transfer (Step 4). 

The accounting procedures for a foreign exchange 
of $100 for £60 at a Correspondent Bank 2 are shown in 
Fig. 16. The Transaction money module 4, in this example, 
requests that its $100 be used to "purchase" £60 from the 
Correspondent Bank's Teller money module 5, which causes 
the Correspondent Bank's Foreign Exchange account to be 
credited by £60 while its Money Due account is debited by 
$100 (Step 1) . The $100 stored in the Transaction money 
module 4 is transferred to the Correspondent Bank's 2 
Teller money module 5, which sends a request to the 
Issuing Bank's 1 Teller money module 5 to withdraw £60, 
and debits its Foreign Exchange account by £60 and credits 
its Deposited at Issuing Bank account by £60 (Step 2) . 

The corresponding account transaction at the 
Issuing Bank 1 debits the Correspondent Bank Money account 
by £60 and credits the Money Issued account by £60 (Step 
3). The Issuing Bank's Teller money module 5 then 
requests that the Money Generator module 6 create £60 and 
transfer it to the Issuing Bank's Teller money module 5, 
which in turn transfers it to the Correspondent Bank's 2 
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° Teller - money module 5 (Steps 4-5) . Prom there, the £60 
note 11 is transferred to the Transaction money module 4, 
leaving it with a balance of £60 while the Correspondent 
Bank r s 2 Teller money module 5 finishes with a balance of 
$100 (Step 6) . 

5 The accounting transactions for a withdrawal or 

deposit of credit notes 11 also involve several accounting 
operations, as shown in Figure 17. When a subscriber 
wishes to withdraw money from his/her credit line (Step 
1}, the proper credit note 11 is simply transferred from 
10 the Money Generator module 6 to the Transaction money 
module 4, reducing the customer's credit line by an equal 
amount to the amount transferred (Steps 2-4) . 

Alternatively, when credit notes 11 are 
deposited by a subscriber's Transaction money module 4, 
15 the subscriber's account is increased by the amount 
deposited, and the Honey Due account is debited by an 
equal amount (Step 1). 

The accounting operations involving the Issuing 
Bank's 1 receipt of cleared electronic money will now be 
2o described. Referring to Figure 18, in this example $100 
of electronic money and $100 of credit notes 11 have been 
cleared by the Clearing Bank 3 to settle the balances 
among several Issuing Banks 1. The $100 of electronic 
money and the $100 of credit notes are transferred to the 
25 proper Issuing Bank 1 (Step 1) . Additionally, $50 of 

electronic notes 11 that it has issued are also deposited 
at the Issuing Bank 1. Consequently, the Issuing Bank 1 
will debit the subscriber's account A by $100, debit the 
Issuing Bank's Money Issued account by $150, credit the 
30 Money Due Account by $50 and credit the Issuing Bank's 

Deposited at Clearing Bank account by $200 to complete the 
transaction. 

Turning now to Fig. 19, an accounting example of 
an exchange of cash for electronic notes 11 at an Issuing 
35 Bank 1 is shown. In this example, the subscriber wishes 
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, to exchange $50 of cash for $50 of electronic notes 11 to 
add to the $100 of electronic notes ll already stored in 
his/her Transaction money module 4. 

In the first transaction, the $50 of cash is 
deposited at the Issuing Bank 1 which causes the Money In 
Transit account to be credited by $50, while the cash 
account is debited by $50 (Step 1) . 

Next, the $100 of electronic notes 11 in the 
Transaction money module 4 is removed, resulting in the 
Money In Transit account being credited by $100, while the 
Money Due account is debited by $100 (Step 2) . 

The Teller money module 5 will now request $150 
of electronic notes 11 from the Money Generator module 6 
to return $150 of electronic notes ll to the subscriber 
(Step 3) . Accordingly, the Money In Transit account is 
debited by $150 while the Money Issued account is credited 
by $150. 

The newly generated $150 of electronic notes 11 
is then transferred from the Money Generator module 6 to 
the Teller money module 5, who in turn transfers the $150 
to the subscriber's Transaction money module 4 (Step 4-5). 
The completed transaction leaves the subscriber with $150 
of electronic notes 11 and the Issuing Bank's Cash account 
containing a $50 balance. 

Also shown parenthetically in Fig. 19 is the 
case when the subscriber exchanges $50 of cash for 
electronic notes 11 when there is a zero balance in 
his/her Transaction money module 4. In Step 1, the $50 of 
cash is deposited at the Issuing Bank 1 which causes the 
Money In Transit account to be credited by $50, while the 
cash account is debited by $50. Since no notes 11 are 
removed, no accounting . is performed in Step 2. 

In Step 3, only $50 is requested from the Money 
Generator module 6, and the Money In Transit account is 
debited by $50 while the Money Issued account is credited 
by $50. The same transfer between money modules occurs as 
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in Steps 4-5 of Fig. 19 described above, using only the 
$50 that was requested- This would leave the subscriber 
with $50 of electronic notes 11 in lieu of his original 
$50 of paper money. 

In Fig. 20, an exchange of cash for electronic 
notes 11 at a Correspondent Bank 2 is shown. This example 
uses the same parameters as in Figure 19, namely, the 
subscriber has $50 of cash and $100 of electronic notes 11 
in his Transaction money module 4. 

When the $50 in cash is deposited to the 
Correspondent Bank 2, its Money In Transit account is 
credited $50 while its Cash account is debited $50 (Step 
1) . The $100 of electronic notes 11 is then transferred 
from the Transaction money module 4 to the Correspondent 
Bank 2 which credits its Money In Transit account by $100 
and debits its Money Due account by $100 (Step 2) . 

From there, the $100 of electronic notes 11 is 
deposited at the Issuing Bank I, wherein its Money Due 
account is debited by $100 while its correspondent Bank 
Money account is credited by $100 (Step 3) . At the 
Correspondent Bank 2 , the Deposited at Issuing Bank 
account is debited by $100 while the Money Due account is 
credited by $100. 

A withdrawal request is then made by the 
Correspondent Bank 2 for $150 from the Issuing Bank 1 
(Step 4) . This request results in the Correspondent Bank 
2 debiting its Money In Transit account by $150 and 
crediting its Deposited at Issuing Bank account by $150. 

correspondingly, the Issuing Bank 1 Teller money 
module 5 requests $150 of notes 11 from the Money 
Generator Module 6, debits its Correspondent Bank Money 
account by $150 and credits its Money Issued account by 
$150 (Step 5). 

Finally, the $150 of electronic notes 11 is 
transferred from the Money Generator module 6 to the 
Issuing Bank's 1 Teller money module 5 which transfers it 
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to the Transaction money module 4 after passing through 
the Correspondent Bank's 2 Teller money module 5 (Steps 6- 
8). 

Alternatively, a subscriber having only $50 of 
cash and no notes 11 in his/her Transaction money module 4 
is also shown in Fig- 20. As in the first case, the $50 
in cash is deposited to the Correspondent Bank 2, its 
Money In Transit account is credited $50 while its Cash 
account is debited $50 (Step 1) . 

A $50 withdrawal request is then made to the 
Issuing Bank 1, and the Money In Transit account is 
debited by $50 while the Deposited at Issuing Bank account 
is credited $50 (Step 4 , parenthetical entry) . 
Thereafter, $50 is requested from the Money Generator 
Module 6, the Correspondent Bank Money account is debited 
$50 and the money issued account is credited $50 in Step 5 
(parenthetical entry) . Here, $50 in electronic notes 11 
are transferred through the same money module path as 
Steps 6-8 above, to reach the Transaction money module 4. 

Figure 21 illustrates the exchange of electronic 
notes 11 for cash at an Issuing Bank 1. Here the 
subscriber has $100 of electronic notes 11 stored in 
his/her Transaction money module 4 and wishes to exchange 
$50 of the electronic notes 11 for $50 of paper cash. 

After the Transaction money module 4 establishes 
the communications with the Issuing Bank's 1 Teller money 
module 5, all $100 of the electronic notes 11 is removed 
from the Transaction money module 4 (Step 1) . This causes 
the Money In Transit account to be credited by $100 and 
the Money Due account (at the Issuing Bank 1) to be 
debited by $100. 

The Teller money module 5 then requests $50 of 
updated electronic notes 11 from the Money Generator 
module 6, and this transaction requires the Money In 
Transit account to be debited by $50 and the Money Issued 
account to be credited by $50 (Step 2). The newly 
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» generated $50 of electronic notes 11 is then transferred 
to the Transaction money module 4 through the Teller money 
module 5. The $50 of paper cash is then transferred to 
the subscriber through a Teller or ATM (Steps 3-5) . 

Also shown in this figure (parenthetically) is 
5 the subscriber making the same exchange for cash when only 
$50 is stored in his/her Transaction Money Module 4. At 
the issuing Bank, $50 of electronic notes 11 is removed 
for which the Money In Transit account is credited $50 and 
the Money Due account is debited $50. Fifty dollars of 
10 paper cash is then returned to the subscriber since he/she 
only deposited $50 of electronic notes 11 (Step 5) . 

Completing this transaction, in both cases the 
Money In Transit account is debited by $50 while the cash 
account at the Issuing Bank 1 is credited by $50. The net 
15 result is that the subscriber ends up with $50 of paper 
cash and, in the former case only, $50 of updated 
electronic notes 11 in his/her Transaction money module 4. 

The exchange of electronic notes 11 for paper 
cash at a Correspondent Bank 2 is illustrated in Figure 
20 22. As in the example illustrated in Figure 21, although 
the subscriber is only exchanging $50 of electronic notes 
11, all $100 of electronic notes 11 are transferred from 
the subscriber's Transaction money module 4 (Step 1). 
After the notes 11 are transferred, the 
2 5 correspondent Bank's 2 Teller money module 5 credits its 
Money In Transit account by $100 and debits its Money Due 
account by $100. This $100 of electronic notes 11 is now 
deposited at an Issuing Bank 1, causing the correspondent 
Bank 2 to credit its Money Due account by $100 while 
30 debiting its Deposited at Issuing Bank account by $100 
(Step 2). 

At the Issuing Bank 1, $100 is credited to the 
Correspondent Bank Money account while $100 is debited to 
the Money Due account. The Correspondent Bank 2 now makes 
35 a reguest to withdraw $50 of electronic notes 11 from the 
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Issuing Bank 1 (Step 3) . Consequently, the Deposited at 
Issuing Bank account is credited by $50 while the Money in 
Transit account at the Correspondent Bank 2 is debited by 
$50. 

Now, the Issuing Bank's 1 Teller money module 5 
request $50 from the Money Generator module 6 and debits 
its correspondent Bank Money account by $50 while 
crediting its Money issued account by $50 (Step 4). The 
$50 of updated electronic notes 11 is transferred from the 
Money Generator module 6 through Issuing Bank 1 Teller 
money module 5 and the Correspondent Bank 2 Teller money 
1 module 5, back to the Transaction money module 4 in Steps 
5-7. 

Also illustrated is this same example with only 
$50 stored in the Transaction money module 4, which is 
deposited at a Correspondent Bank 2, to be exchanged for 
paper money. For this deposit, the Money In Transit 
account is credited $50, and the Money Due account is 
debited $50 (Step 1) . The $50 is then deposited by the 
Correspondent Bank 2 to its account at the Issuing Bank 1. 
At the correspondent Bank 2, the Money Due account 
receives a $50 credit, while the Deposited at Issuing Bank 
account receives a $50 debit. On the Issuing Bank 1 side, 
it credits the Correspondent Bank Money account by $50 and 
debits the Money Due account by $50 after receiving the 
$50 deposit (Step 2) . 

In both illustrations, fifty dollars of paper 
cash is then transferred from the Correspondent Bank 2 to 
the subscriber, while the Correspondent Bank 2 debits its 
Money In Transit account by $50 and credits its cash 
account by $50 (Step 8) . The subscriber is now left with 
$50 of paper cash and, in the first illustration, $50 of 
electronic notes 11 stored in his/her Transaction money 
module 4. 

Figure 23, the accounting process for clearing 
the electronics money issued by different Issuing Banks is 



WO93/10S03 PCT/US92/09732 



30 



35 



shown. This illustration uses an example in which $100 of 
electronic notes 11 issued by Bank B has been deposited at 
Issuing Bank A, and $150 of electronic notes 11 issued by 
Bank A have been deposited at Issuing Bank B. 

In Step 1, issuing Bank A transfers the $100 
issued by Bank B to the Clearing Bank 3. It then credits 
its Money Due account and $100 and debits its Deposited at 
Clearing Bank account by the same amount. In Step 2, 
Issuing Bank B deposits the $150 of Issuing Bank A's money 
at the Clearing Bank 3. Its Money Due account is credited 
by $150, while its Deposited at Clearing Bank account is 
debited $150. 

In sum, $50 is due to Bank B. Accordingly, $50 
gets debited to the Clearing account of Bank A, while $50 
gets credited to the Clearing account of Bank B (Step 3) . 

In Figure 24, the accounting transactions 
corresponding to updating electronic notes 11 is shown. 
Here, $100 of electronic notes 11 are stored in a 
Transaction money module 4 and are transferred to an 
issuing Bank 1, where $100 is credited to the Money In 
Transit account and $100 is debited to the Money Due 
account (Step 1) . 

One hundred dollars of electronic notes 11 are 
requested from the Money Generator module 6 causing the 
Money In Transit account to be debited by $100 while the 
Money Issued account is credited by $100 (Step 2). With 
this accomplished, the $100 of electronic notes 11 is 
transferred from the Money Generator module 6 to the 
issuing Bank's 1 Teller money module 5, which in turn 
transfers the money to the subscriber's Transaction money 
module 4 (Steps 3-4). 

Reconcil iation and CI Paring Systems 
Referring to Figure 25, the Transaction 
Reconciliation System 22 is shown. It will be understood 
that the Teller money modules 5, the Money Generator 
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modules 6 and the banking system 20 may periodically pass 
transaction records to a Transaction Reconciliation System 
22 maintained at each participating bank. These 
transactions will be analyzed and matched to determine if 
there is any faulty process occurring in the system 20 of 
the invention. 

5 The Transaction Reconciliation System 22, which 

may be embodied in any appropriately sized and suitably 
programmed general purpose computer but is not so limited, 
will ensure that all Teller money module 5 transactions 
with a financial impact, e.g., deposits, and withdrawals 

10 and payments, match the appropriate accounting 

transactions. Any mismatches could indicate incomplete 
transactions or possible fraudulent actions. 

Transactions reflecting the money issued by the 
Money Generator modules 6 also should correspond to Teller 

15 money module 5 transactions and have the appropriate 

accounting transactions recorded. Any mismatched data may 
indicate incomplete processing or a security breach. 
Unmatched accounting transactions may be caused by 
incomplete transactions or an attempt to tamper with the 

20 records of the banking system 20. 

In the preferred embodiment, these unmatched 
transactions may then be transferred to an investigation 
system 12 where the causes of the problems may be 
determined. On-line dialogues may be provided to allow 

25 investigators to review the mismatches against transaction 
records and to determine appropriate actions to correct 
the situation. Investigators may then take corrective 
actions by adjusting accounts, deactivating faulty Teller 
money modules 5 and Money Generator modules 6, and 

30 notifying subscribers of the actions. 

Attention is now directed to Figure 26, which 
illustrates the clearing process for handling deposit 
transactions. Correspondent Banks are not involved in 
this process because subscriber deposits are deposited to 
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■ .their accounts at Issuing Banks 1 on a real-time basis. 
At issuing Banks deposits are aggregated by the Clearing 
System 13 to consolidate all deposited electronic money 
(including the deposits from Correspondent Banks) for 
transmission to the Clearing Bank 3. 

The Clearing Bank 3 may be implemented in any 
5 computer processing facility capable of accommodating the 
large number of transactions and corresponding amounts of 
data which the system will typically handle- A high 
volume mainframe computer, a suitably sized minicomputer 
system, a number of networked work stations having the 
10 necessary data processing capabilities or combination of 
the foregoing may also be used. As will be appreciated by 
a person skilled in the art, the particular design of the 
Clearing Bank 3 hardware system is not critical to the 
, c invention. 

15 It i S anticipated that Issuing Banks X may clear 

money in one of several procedures. In one of these 
procedures, electronic money may be deposited on-line from 
the issuing Bank 1 to the Clearing Bank 3. This could be 
done on-line in a real-time mode when transactions are 

20 actually occurring. Alternatively, an Issuing Bank 1 may 
record the details of transactions being performed during 
the course of the day for later batch processing, 
interbank processing could occur several times a day. 

As shown in Figure 26, an Issuing Bank 1 may 

25 periodically transfer its electronic money to a deposit 
consolidation file (consolidate deposits) which may be 
processed and transmitted to the Clearing Bank 3. 
Transaction records from this file are also conveyed to 
the bank's Transaction Reconciliation system 22 for 

30 statistical and housekeeping functions. 

At the Clearing Bank 3, the deposit 
consolidation files are processed creating a single debit 
and credit by the monetary unit for each Issuing Bank's 1 
demand account. Of course, the appropriate accounting 
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" transactions for these demand accounts are posted during 
the clearing processes. Any accounts which are overdrawn 
will be settled via the usual interbank settlement 
processes that are commonly used in the industry. 

The processed electronic money that is cleared 
5 is sent back to the Money Issued Reconciliation System 23 
of each of the banks that issued it in order to be 
reconciled and checked for tampering and duplication. 

Additional statistical and housekeeping 
functions are implemented in the Money Issued 
10 Reconciliation system 23, as shown in Figure 27. Issuing 
Bank's 1 provide their own Money Issued Reconciliation 
System 23, typically embodied in a general purpose 
computer but not so limited, for matching the electronic 
money issued to the electronic money cleared at the 
15 Clearing Bank 3. 

As indicated in Figure 27, the electronic money 
issued and electronic money deposited at Issuing Banks 1, 
and money cleared transactions received from clearing bank 
3 are conveyed to the Money Issued Reconciliation system 
2o 23. The Money Issued Reconciliation system 23 generates 
accounting transactions for the money cleared, and updates 
a master file of all the bank's money issued. 
Additionally, the Money Issued Reconciliation system 23 
passes to an investigation subsystem 13 money which has 
25 cleared but which was not issued or was possibly 
transferred more than once. 

Any unmatched cases may indicate a potential 
breach of security. Investigators may then determine 
whether Money Generator modules 6 are not working properly 
30 or money modules are being tampered with. Money module 
identifiers of faulty or abused money modules are passed 
to each bank's Security Servers 27 for distribution to the 
other money modules on the bank's local network 18. The 
identifiers are also sent to the Certification Agency 28 
35 for appropriate distribution throughout the Network 25. 
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Separately, the Money Issued master file is 
" accessed by the Money Position system 24 which creates a 
file to be transmitted to the Clearing Bank 3 to create a 
consolidated money position. It is contemplated that all 
issuing Banks 1 will provide a report reflecting their 
, position at the end of a specified period, typically at 
the end of every day. The Money Position System 24 may 
consolidate these reports to reflect the amount of money 
issued by the Issuing Banks 1 for each monetary unit. The 
reports will reflect the outstanding position of each 
1Q issuing Bank 1 in order to assess the risk of interbank 
settlement problems. 

"T— seguences 
Although some aspects of the preferred 
embodiment may be described in terms of detailed schematic 

15 diagrams, the transaction functions are best illustrated 
by use of process flowcharts. Thus, to facilitate 
understanding of the operation of the money modules, 
several examples .of transactions are set forth in the 
flowcharts of Figures 28-50A. Referring to these figures, 

20 a detailed description of the system processes and the 
associated application functions that incorporate the 
principles of the preferred embodiment of the present 
invention will now be described. 

Throughout the descriptions of the flowcharts 

25 (except where indicated otherwise) , the application 

functions of the Transaction money module 4, whether they 
are imbedded in a hand-held unit or other type of 
processing device, are hereinafter designated with the 
suffix "A" , and the Teller money module 5 applications and 

30 its associated bank are hereinafter designated with the 
suffix "B". in the case where a Correspondent Bank 2 
interacts with an Issuing Bank 1, the Issuing or 
Correspondent Bank i and its associated Teller money 

35 module 5 applications are hereinafter designated with a 
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Additionally, transitions to steps in another 
figure are indicated by a pentagonal tag having an 
alphanumeric symbol, and continue on the other figure with 
a circle having the same alphanumeric symbol therein. 

Withdrawal From An Issuing Bank 

In Figures 28-35A, a process flowchart of a 
transaction between a Transaction money module 4 and an 
Teller money module 5 is shown. In this process example, 
it is assumed that the subscriber is desirous of 
completing a monetary transaction with a participating 
bank; specifically, a withdrawal of some amount of 
electronic money from his/her account, to be stored in 
his/her Transaction money module 4. 

The process flow to set up a withdrawal 
transaction begins at the top of Figure 28. The first 
flow bock is a withdrawal set up between a money module A 
and a bank's Teller money module B 5, which is described 
further in Figure 29. This process begins with money 
module A performing a sign-on process that is also 
described in further detail in another figure, 
specifically Figure 31. 

Subscriber Sign-On 

Referring to the top of Figure 31, the 
subscriber prompts his/her Transaction money module 4 to 
perform a sign-on function (Step 10) . The Session Manager 
31 application receives the sign-on message (Step 12) and 
checks to see if the Transaction money module 4 has 
inhibited subscribers from signing on (Step 14). 

Subscriber sign-on may be inhibited if a user 
makes several unsuccessful attempts to sign-on to the 
Transaction money module 4. For example, the allowable 
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„ attempts to sign-on may be limited to three, such that if 
a person makes more than three consecutive unsuccessful 
attempts to sign-on to the Transaction money module 4, the 
Session Manager 3X will prohibit any further sign-on 
attempts. Additionally, this "lock-out" feature may be 
5 maintained for any predetermined time period, such as 
twenty- four hours, for example. Such an arrangement will 
provide security from persons who come into possession of 
the Transaction money module 4 but who are not properly 
authorized to access it. It should be noted that 

1Q while this type of an arrangement is anticipated in the 
preferred embodiment of the invention, the invention 
should not be limited as such, since any of the methods 
known in the industry for providing security from 
unauthorized persons would be suitable for use herein. 

When the sign-on is not inhibited, as will 

15 typically be the case, To Subscriber 33 prompts the 

subscriber to enter his/his sign-on characteristics, such 
as his/her PIN and biometric identifiers (Step 22) . 
Inputs from the subscriber are forwarded through the 
Session Manager 31 to the To Subscriber 33 application 

20 (Steps 24-28) , which responds to the characteristics 
entered and entitles the subscriber to operate the 
Transaction money module 4 if the subscriber's 
identification characteristics are the correct ones when 
compared to those stored in the memory of the Transaction 
money module 4 (Steps 30-32) . 

If the subscriber's identification 
characteristics do not match the identifiers stored in 
memory, the To Subscriber 33 application notifies the 
subscriber of the invalid sign-on condition (Step 34) . 
From there, the To Subscriber 33 application checks to see 
how many times the user has attempted to sign-on (Step 
36), and if the predetermined count has not been reached, 
the Session Manager 31 is notified (Step 38) . 

The Session Manager 31 works in conjunction with 
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« the Clock/Timer 43 application to set and to monitor the 
time that has elapsed between unsuccessful sign-on 
attempts (Step 40) . In one embodiment, too many 
unsuccessful attempts within the set time period will 
cause the Session Manager 51 to prohibit any further sign- 

5 on attempts, effectively shutting down the Transaction 
money module 4. The Session Manager 31 notes that the 
sign on is terminated in Step 42. 

Turning back to Step 14 of Figure 31, assuming 
that the Transaction money module 4 is inhibited, the 
10 Session Manager 31 checks to see if the predetermined time 
period has expired (Step 16) . If the Transaction money 
module 4 is still in the prohibited sign-on mode, the To 
Subscriber 33 sends a message to the subscriber that 
further access to the Transaction money module 4 is 
15 prohibited (Steps 18-20) . The Session Manager 31 notes 
that the sign-on attempt is terminated, again in step 42. 

Setup Withdrawal 

2Q Turning to Figure 29, when a proper sign-on is 

accomplished, the To Subscriber A 33 prompts the 
subscriber for the type of transaction that is desired 
(Step 43). As mentioned previously, it is anticipated 
that a subscriber may transact with any one of a multitude 

25 of accounts at several different participating banks and 
financial institutions. 

After selecting the particular bank and account 
(Step 44) , the Transaction money module 4 initiates a 
procedure for communicating with the bank that was 

30 selected, by engaging the Network 25. The overall program 
flow now passes to the procedures illustrated by 
flowcharts in Figure 33. In Figure 33, there is shown the 
data processing and flow for implementing a sign-on to the 
Network 25. 
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„ Network Sign-On 

The illustrative Network 25 sign-on method about 
to be described is in general applicable to any of the 
money modules 4,5,6 of the present embodiment. Thus, in 
5 this example, "A" denotes any class of money module. 

After the bank that is to be accessed is 
selected, the money module initiates communication with 
the Network 25 under the control of its Session Manager A 
31 (Step 50) . The Network Server 26 begins by requesting 
the certificate of the Transaction money module 4 from 
Session Manager A 31 (Step 52-54) . The Maintain Security 
A application 37 retrieves and sends the certificate to 
Session Manager A 31 (Step 56) . Session Manager A 31 
sends the certificate to the Network Server 26 (Step 58) , 
15 which, upon receipt, routes it to the Security Server 27 
(Step 60). 

The Security Server 27 tests the certificate to 
check its validity (Step 62-64) , and if it is not valid 
for any reason, the Security Server 27 will signal the 
20 Network Server 26 to deny access (Step 66) . The Network 
Server 26 may in turn convey an access-denied message to 
session Manager A of the Transaction money module 4 (Step 
68-70) . 

If the Session Manager A that receives the 
25 denied access message is a Transaction money module 4, its 
To Subscriber application A will inform the subscriber of 
this condition (Step 74). If it is a Teller money module 
5 or Money Generator Module 6 that is trying to access the 
Network 25, the To Bank A application 47 notifies the 
30 bank's systems 20 that its access will not be permitted 
(Step 76). 

Assuming the certificate validity check is 
satisfied, the Security Server 27 sends an updated list of 
the bad money modules, and a new list of certif icatory 
35 keys to the Session Manager A, (Step 78, Fig. 33A) . The 
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u keys are signed using the last version of the 
certificatory key. This information is received by 
Session Manager A and forwarded to the Maintain Security A 
37 application, which will validate the certificatory key 
list and the bad money module list (Steps 80-82, Fig. 

5 33A). 

Public Key A 44 tests the validity of the 
signature (Step 84) and if the signature is not valid, a 
message warning of a network security problem is sent by 
the To Subscriber application A 33 of a Transaction money 

10 module 4 (Steps 86-90) , or alternatively, by the To Bank 
application A application of a Teller money module 5, 
(Steps 86-88, 92). Advantageously, all money modules will 
check the validity of a signature received from even the 
Security Server 27. This helps to ensure the integrity of 

15 the overall system. 

In the case of a valid signature, Maintain 
Security A updates the bad money module list and the 
certificatory key list. (Step 94) . If the certificate is 
to be recertified or the certificate has expired (Steps 96 

20 and 98) , the Maintain Security A generates a new 

certificate (Step 126 of Figure 33C) while Public Key A 
generates new keys and signs the certificate using the old 
public key (Step 128) . Session Manager A sends the new 
certificate to the Security Server 27 who takes the 

25 certificate and tests the validity of the signature (Steps 
130-136) . 

Assuming that the signature of the new 
certificate is not valid at this stage, Steps 66-76, Fig. 
33, are repeated so as to terminate the communication link 
30 into the Network 25. 

On the other hand, a valid signature, Fig. 33C, 
will allow the Security Server 27 to sign the new 
certificate and send it back to the money module (Step 
138) . Session Manager A 31 receives the new certificate, 
35 step 140, Fig. 33D, and forwards it to its Maintain 
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- Security application A to again validate the certificate 
through use of the Public Key application (Steps 142-146) . 
Here, the money modules will repeat the test of the 
validity of the certificate issued from the Security 
Server 27. For a valid signature, the Session Manager A 

5 31 sends an acknowledgment to the Security Server 27 (Step 
148) who responds by returning the process to Step 78, 
Fig. 33A. 

Conversely, if the Security Server's signature 
on the new certificate generated by Transaction money 

10 module A proves to be invalid, Fig. 33D, Session Manager A 
will send an invalid certificate message along with the 
certificate back to the Security Server 27 (Step 150) , 
which will again attempt to validate the signature on the 
certificate (Step 152). A valid signature will return the 

15 process to step 66, Fig. 33. Alternatively, an invalid 
signature will cause the security Server 27 to disconnect 
from the Network 25 (Step 156, Fig. 33D) and cause the 
Network Server 26 to notify the money module of a 
malfunction (Step 158) . 

2Q The Session Manager A that receives the message 

(Step 160) will, in the case of a Transaction money module 
4, get the To Subscriber A 33 to inquire of the subscriber 
if they desire to retry the whole process of signing on to 
the Network 25 (Step 164 & 168) . In the case of a Teller 

25 money module 5 or a Money Generator Module 6, the To Bank 
application A will inquire if there is a request to retry 
the Network 25 sign-on procedure (Step 166 & 168) . 

No attempts for a retry will, of course, end the 
communication link into the Network 25, and conversely, a 

30 request for retry of Network 25 access will return the 
procedure back to Step 56, Fig. 33, wherein Maintain 
security A will again retrieve the Transaction money 
module «s certificate for the Network Server 26. 

Back at Step 98, Fig. 33A if the certificate 

35 does not need to be recertified or has not expired, 
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u Session Manager A 31 will request the date and time (Step 
100) from Clock/Timer A (Step 102, Fig. 33B) , and forward 
this data to the Network Server 26 (Step 104). 

The Network Server 26 checks the time and date 
after receiving it (Step 106) and if it is outside of an 
5 acceptable predetermined parameter, the Network Server 26 
will send the new time and date (Step 110) to Clock/Timer 
A through Session Manager A (Steps 112 & 114). If 
Clock/Timer A 43 cannot adjust the date and time to be 
synchronized with the Network 25, the operator of the 

10 money module for subscriber or the bank is notified of the 
clock malfunction (Step 116-124). 

In response to the apparent malfunction, the 
operator may attempt to have the time and date resent from 
the Network Server 26, Step 124, and the procedure reverts 

15 back to Step 102 in which it attempts to send the new date 
and time to the money module. Alternatively, an 
acceptable date and time check, Step 108 allows the 
Network Server 26 and Session Manager A to exchange 
acknowledgements and note the successful Network 25 sign- 

20 on (Step 126-128) . 

Establishing A Session 

As shown in Figure 29, after the steps of money 
25 module sign-on, transaction selection and network sign-on 
are completed, sessions are established between the money 
modules. Figure 34 diagrams the flow process for 
establishing a money-module to money-module session, 
which, as will be understood by one skilled in the art, 
30 will in general be applicable as well to other sessions 
established between the various types of money modules of 
the present invention. 

Referring to the top of Figure 34, the Session 
Manager A will first check to see if the subscriber has 
35 requested connection to a specific destination in the 
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- Network 25. (Step 190). For instance, where a subscriber 
is desirous of transacting with his/her account at a 
specific bank, the Network 25 will connect the Transaction 
money module 4 to the selected bank, Steps 192-198. 
Conversely, when a subscriber is performing updating 
e functions on the Network 25, there is no need to establish 
a session with any specific bank, and the Network server 
26 may decide where to route the connection, based on 
Network 25 traffic. 

If a specific destination has been selected by 

. 0 the subscriber, Session Manager A conveys the destination 
information to the Network Server 26 (Step 194) . The 
Network Server 26 initiates a communication link to the 
money module of the selected destination (Step 196) and 
sends an acknowledgement to session Manager A 31. 

After receiving the acknowledgement that the 

15 destination money module has been contacted (Step 198) , 
the Maintain Security application A will send its 
certificate to the Maintain Security application B through 
each application's respective Session Manager (Steps 200- 

20 20 } it is anticipated that the money modules will 

exchange certificates to verify that each money module is 
interacting with another valid money module. To this end 
(as seen in Fig. 34A) , the Public Key application B 44 
tests the certificate of money module A by. using the 

25 public key algorithm and the public key corresponding to 
the private key used by money module A, to encrypt and 
check A's certificate and verify that it is valid (Step 
208) . 

If the certificate is found invalid, the session 
30 Manager B will note the session is terminated (Step 210) . 
In the case of a Transaction money module 4, the To 
subscriber B informs the subscriber of the transaction 
termination (Setup 212) . Likewise, a Teller money module 
35 5 of Money Generator Module 6, uses the To Bank 
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« application B 47 to notify the bank of the termination, 
Step 213. It is anticipated that the counterparty money 
module will then timeout to end the exchange. 

In Step 214, Fig. 34A, assuming that the 
certificate of money module A is valid, the Maintain 
5 Security application B 37 checks to see if Transaction 
money module A is on the list of compromised money modules 
(Step 215) . If money module A is on that list, the 
process flow returns to Step 210 so that the 
communications can be terminated. 

1Q Alternatively, when money module A is not on the 

list of compromised money modules, then Random Number 
Generator B 46 creates a session key (Step 216) and 
encodes the session key along with money module B's 
certificate and a verification message, using money module 

15 A's public key (Step 218). This encoded message is sent 
to money module A by Session Manager B 31 (Step 220) . 

Session Manager A 31 receives the message from 
money module B (Step 222), and uses its Public Key 44 
algorithms application to decode the message (Step 224, 

2 g Fig. 34B) , and to verify money module B's certificate 
(Step 226) . 

If the test determines that money module B's 
certificate is invalid, the operation branches to an 
"abort transaction" procedure to terminate the steps taken 
25 thus far in establishing a session (Steps 500-524) . This 
procedure may be used, for example, to end the 
communication session and to functionally shut off money 
module A, which results in the communication link ending. 
(Steps 500-524, Figure 32). 

30 

Abort Transaction 



35 



Branching to Figure 32, the functional shut-off 
of a money module through the abort transaction process 
will now be described in detail. It will be understood 
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that the following process may be used when any two money 
modules are abnormally terminating the transactions 
occurring between them. Accordingly, the money modules 
will be designated -X" and «Y" to illustrate the generic 
applicability of the process steps. 

An abort transaction process initiated by money 
module X to terminate communications with money module Y 
begins with Session Manager X 31 capturing and then 
reversing or rolling back any programmatic changes that 
were made to the money module (Step 500) , and then noting 
that the session has been aborted (Step 502). 

In the case where the money module that is 
initiating the termination is a Transaction money module 
4, the To Subscriber application 33 informs the subscriber 
of the communication termination (Step 510) . Likewise, a 
Teller money module 5 informs its To Bank application 47 
of the termination so that any accounting changes may be 
undone (Step 508) . Next, the Session Manager X 31 of the 
terminating money module sends an encoded message to the 
other money module involved (Step 512) . 

Briefly referring to Figure 37, all encrypted 
messages between modules will be provided by the following 
steps. The sending money module (here also referred to as 
"X") uses its Symmetric Key 45 to encode the message to be 
sent to the receiving money module (here also referred to 
as M Y M ). (Step 2). Again, it will be appreciated that 
there are a number of known encryption techniques which 
may be utilized. 

The Session Manager X 31 sends the encoded 
message to Session Manger Y 31 which in turn decodes the 
message using its Symmetric Key Y 45 (Steps 4-8) . 

Continuing with Figure 32 , the Session Manger Y 
responds to the termination notice sent by also undoing 
any changes it may have made towards establishing the 
session, and noting the aborted session (Steps 514-516) . 
If it is a Transaction money module 4 that is now shutting 
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" down, the To subscriber application 33 alerts the 
subscriber of the condition (Step 518 & 524). 
correspondingly, in a Teller money module 5, the To Bank 
application 47 will reverse all accounting transactions 
that have been undertaken (Steps 518-522). 
5 Returning to Figure 34 B, assuming that the money 

module B certificate is valid, in Step 228 Maintain 
Security A checks to see if money module B is on the list 
of compromised money modules. If money module B is on the 
list (Step 230) , the session reverts to the abort 
10 transaction procedure. Steps 500-524. Thereafter, the 
communications session is dissolved. 

More typically, money module B will not be on 
the list of compromised money modules, and the Clock/Timer 
A 43 will retrieve the date and time (Step 232) and send 

15 this information to the Maintain Security application A 37 
so that the verification message may be assembled with the 
date and time (Step 234). 

Symmetric Key A 45 then encrypts the 
verification message with the date and time information, 

2o using the random session key provided by money module B 
(Step 236) . Session Manager A 31 sends this encrypted 
message (Step 238) to Session Manager B 31 (Step 240) . 
From there, the Symmetric Key application B 45 decrypts 
the message (Step 242) and passes it to the Maintain 

25 Security B 37 for message verification (Step 244, Fig. 
34C) . An incorrect message will cause the session to be 
aborted through Steps 500-524, while a correct message 
will advance the procedure so that Maintain Security B 37 
can compare the time and date with that of money module A 

30 (Step 248) . 

Clock/Timer B 43 will verify that money module 
A's clock is within a preset amount of deviation from the 
clock of money module B (Step 250) . If the discrepancy 
between the two clocks is greater than a predetermined 

35 amount, the session will be aborted by branching to Steps 
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If there is no discrepancy that is greater than 
the permissible amount. Session Manager B 31 will note its 
start of a session (Step 252) , and send an acknowledgement 
to money module A to start the transaction (Step 254) . 
After the encoded message is sent from money module B to 
5 session Manager A 31 using process steps 2-8, Fig. 37, 
Session Manager A 31 acknowledges the message receipt and 
also notes the start of session (Steps 256-258) . 

Request Withdrawal 

10 

After a session is established between the 
Transaction money module 4 and Teller money module 5, the 
Transaction money module 4 makes a withdrawal request 
from the Teller money module 5. See Figure 29. Referring 

15 now to Figure 30, a process for requesting a withdrawal 
will now be described. It should be noted that although 
the figure denotes the parties as W X" and n Y. tt in the 
process steps describe below, they are applicable to any 
money module transacting with a Teller money module 5. 

20 to begin, the To Teller X 34 sends a withdrawal 

request to the Teller money module 5, requesting a certain 
amount of money to be withdrawn from a specific account. 
In its transmission of the withdrawal request, the account 
number and the account profile will be transmitted from 

25 the requesting money module to the Teller money module 5 
(Step 700) . to send this request, the process Steps 2-8 
are repeated, in which the message is encrypted using the 
previously described cryptographic techniques. 



30 



Validate Account Number 



Once the withdrawal request and the account 
number and profile are transmitted to the Teller money 
module 5, a procedure to validate the account number is 
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initiated (Steps 7041-7055) . A flow diagram depicting how 
an account number is validated is shown in Figure 38. 

In this process, the Maintain Security 
application 37 of the Teller money module 5 receives the 
account profile and signature and conveys them to its 
Public Key application 44 to verify the profile signature 
(Steps 7041-7042). The signature is tested using the 
public key generated and distributed by the Bank's 
Security Server 27. An invalid signature causes the 
Maintain Security 37 application to inform the Session 
Manager that the account profile is invalid (Step 7044) , 
whereby Steps 500-524, Fig. 32, are followed to abort the 
transaction between the two money modules. 

If the signature test confirms a valid 
signature, the procedure advances to the To Bank 
application 47 which sends the account number it has 
received on to the bank's computer systems (Step 7046). 
An inactive account will cause the Maintain Security 
application 37 to inform the Session Manager of the 
inactive account (Step 7048) and have the transaction 
aborted following steps 500-524; an account that has not 
been inactive will allow the Maintain Security application 
37 to check if the account profile needs to be recertified 
(Steps 7047-7050) . 

If the account profile does need to be 
recertified, the Maintain Security application 37 will to 
send the account profile to the Security Server 27 (Fig. 
38A, Steps 7051-7052), when will recertify the account 
profile and send it on to the Teller money module 5 (Step 

7053) . In response, the Teller money module 5 sends it to 
the money module making the withdrawal request (Step 

7054) . 

The communication from the Teller money module 5 
to the money module utilizes the previously described 
routine for sending messages, Steps 2-8. The Maintain 
Security application 37 then updates the account profile 
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> in the money module and returns an acknowledgement to the 
Maintain Security application 37 in the Teller money 
module 5 (Step 7055), also using Steps 2-8. The 
electronic message is received by the Maintain Security 
application 37 of the Teller money module 5, and 

; acknowledged in Step 7056. 

With the account information checked, the 
process returns to Step 704 of Figure 30. The To Bank 
application 47 now verifies that there are sufficient 
funds to support the withdrawal request (Step 704) . 

j sufficient funds will prompt the return of an 
acknowledgement to a Transaction money module 4, utilizing 
process steps 2-8 to transmit the acknowledgement to its 
To Teller 34 application function (Steps 706-714) . In the 
case of a Teller money module 5, no acknowledgement is 

I required. . 

In the case of a Transaction money module 4, an 
insufficient amount of funds will cause the subscriber to 
be prompted to enter a new amount for the withdrawal 
(Steps 718-720, Figure 30A) . As shown by Step 724, the 
newly entered amount causes the To Teller application 34 
1 to send the new request to the To Bank application 47 
(using Steps 2-8) of the Teller money module 5 to verify 
if there are sufficient funds to cover the latest 
requested amount, returning to Step 704 of Fig. 30. If 
the new request is still greater than the funds on balance 
at the bank, the Teller money module 5 will initiate Steps 
500-524 to abort the transaction between the to money 
modules. In the case of a Teller money module 5, the 
transaction is allowed to overdraw the account. 

Transfer Notes 



35 



Referring back to Figure 29, To Teller A 34 
transfers the total of its currency notes IX to the Teller 
money module 5 (Step 45) . If there are no notes 11 being 



PCI7US92/09732 



- 81 - 

- held in the Transaction money module 4 at the time the 
withdrawal request is made, the To Teller A application 34 
sends a message to the Teller money module 5 that there 
are no notes 11 present (Step 47) , using process Steps 2- 
8. 

5 Electronic notes 11 are transferred between 

money modules using the procedure described below 
(referring now to Figure 39) . The Note Directory 
application 39 of the transfer or money module chooses the 
notes 11 of proper values for the transfer (Step 750) , and 

10 has the Notes application 40 create a transfer for each 
note 11 (Step 752) . The Public Key application 44 creates 
signatures for all the notes 11 (Step 754) and sends the 
notes 11 to the Packet Manager application 41, for 
assembling the note 11 transfers and signatures into a 

15 packet to be sent to the requesting money module (Step 
756) . 

steps 2-8 are utilized to transfer the packet of 
electronic notes 11 to the Packet Manager application 41 
of the requesting money module for receipt and disassembly 
2 0 (Step 758) . The Verifier application 42 verifies the 

transfers appended to the certificates, and verifies that 
the total amount conforms to the notes 11 that should be 
sent (Step 760) . 

Any invalid information will cause the 
25 transaction between the two money modules to be aborted, 
using the procedure outlined in Steps 500-524 above (Step 
761) . Valid notes 11 will have their expiration dates 
checked (Step 762) by the Verifier application 42 when it 
is a Transaction money module 4 that has conveyed the 
30 notes 11 (Step 763). Any expired notes 11 (Step 764) will 
cause the sessions to be aborted using the procedures 
outlined in Steps 500-524, Fig. 32. 

Assuming the notes 11 have not expired, or in 
the case where a Teller money module 5 is accepting them, 
35 the process flow resumes at Step 765, Fig. 39A. In this 
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Step, the Public Key Y application 44 verifies the digital 
signatures. Invalid signatures invoke the transaction 
abort process of Steps 500-524. 

Valid electronic notes 11 are then sent to the 
Notes application 40 (Step 768) and the Note Directory 39 
is updated with the new note locations and amount (Step 
770) . 

Returning to Figure 28, the To Transaction B 49 
checks if the electronic notes 11 have been transferred 
(Step 772) , and if notes 11 have indeed been transferred 
from a Transaction money module 4, accounting transactions 
are posted to reflect this situation (Step 776? see also 
Fig. 14, Step 1) by the To Bank application B 47. Both in 
the case when no notes 11 have been transferred from the 
money module, and after the later accounting transactions 
are posted in Step 776, a session is established between 
the Teller money module 5 and the Money Generator module 6 
using the procedure outlined above in steps 190-258, Figs. 
34, 34A-C. 

As notes 11 are requested to satisfy the 
withdrawal, an account posting occurs to reflect the 
request. The To Bank application B 47 will post the 
proper accounting transactions (Step 778, Fig. 28) as also 
illustrated in Figure 14, Step 2. 



Request Notes 

25 

Directing attention to Figure 40, notes 11 may 
be requested between Teller money modules S and Money 
Generator modules 6 using the following procedure 
described below. 
30 The To Money Generator application 48 of the 

requesting Teller money module 5 will issue a request for 
a specific amount of electronic money to be created (Step 
780) . The request will be sent using the above described 
Steps 2-8 for encrypted transmission, to the To Teller 
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, application 34 of the Money Generator module 6 so that the 
Honey Creator application 50 may be activated (Step 784) 
to create the electronic notes 11 (Step 786) . 

After the creation of electronic notes 11, they 
are signed by the Public Key application 44 of the Money 
Generator module 6 (Step 788) and placed in a holder by 
its Notes application 40 (Step 790) . Finally, the Note 
Directory 39 is updated with the information about the 
newly created electronic notes 11 (Step 792) . 

The process flow now returns to the procedures 
shown in Figure 28. The requested notes in the Money 
Generator module 6 are transferred to the Teller money 
module B S using the process Steps 750-770 outlined above 
for transferring electronic notes 11. The notes 11 are 
then transferred from the Teller money module B 5 to the 
Transaction money module 4 using these same process Steps 
750-770 for transferring electronic notes 11. 

Finally, to successfully complete the withdrawal 
of electronic notes 11, the money modules will "commit" to 
or finalize the transaction by utilizing the following 
procedure. Referring now to Figure 41 for a detailed 
description of this process, the Tran Log Mgr. application 
36 updates its Tran Log to record the transaction that has 
occurred above (Step 690) . When it is a Transaction money 
module 4 that is committing to the exchange (Step 691) , 
the To Subscriber application will notify the subscriber 
that the transaction has been successfully completed (Step 
692) . Of course, the Session Manager application A 31 
will note the end of session (Step 693), and employ 
process Steps 2-8 to send the message to the money module 
it is transacting with. 

with this end of session notice received, the 
other money module, in this example a Teller money module 
5, will use its Tran Log Mgr. application 36 to update its 
own Tran Log (Step 694) . Assuming, however, the second 
money module receiving the end of session notice is not a 
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, Teller money module 5 r an additional step of having the To 
Subscriber application 33 notify the subscriber of the end 
of the transaction occurrence (Step 696) will be 
necessary. Thereafter, the Session Manager 31 of the 
second money module in both cases will also make note of 

. the end of the session (Step 698) . 

* Directing attention back to Figure 28, the 

process to commit is initiated first by the Transaction 
money module 4 committing its transaction with the Teller 
money module B 5 (Steps 690-698) . The process steps are 
also applied to commit the transaction between Teller 

1 money module B 5 and the Money Generator module 6 (Steps 
690-698) . That completes the processing for one complete 
withdrawal of electronic money from an Issuing Bank 1. 

Withdrawal From A Correspondent Bank 

A withdrawal from a Correspondent Bank 2 will 
now be described, aided by reference to Figure 35. To 
begin, the previously described Steps 43-48 to set up a 
withdrawal are undertaken by a Transaction money module A 
' 4, in conjunction with an Teller money module B 5. Next, 
Steps 190-258, used to establish a session, also described 
above, are initiated between Teller money module B 5 and 
Teller money module C 5. After the sessions have been 
established, the To Bank application B 47 will pos|t the 
accounting transaction corresponding to the withdrawal 
that is going to subsequently occur (Step 900; see also 
Fig. 13, Step 1). 

As previously noted, it is contemplated that 
whenever a Transaction money module 4 interacts with a 
bank, both Issuing 1 and correspondent 2, all electronic 
notes 11 that are stored within the Transaction money 
module 4 are removed and replaced with electronic notes 11 
containing the most recent certificate. To perform this 
operation, To Transaction B 49 will check to see if there 
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o are notes 11 stored within the Transaction money module 4 
(Steps 902-904). If there are notes 11, To Bank B 47 will 
post the appropriate accounting transactions (see 
accounting procedure illustrated in Figure 13; Step 2) 
(Step 906) , and perform a deposit request from the Teller 
5 money module C 5 (associated with an Issuing Bank 1) to 
return the notes 11 that need to be replaced. 

For a detailed description for performing a 
deposit request, attention will be directed to Figure 44. 
Here, the To Teller application 34 sends a deposit request 

1Q message, the amount of the deposit to be sent, the account 
number and the account profile of the account to which the 
notes 11 will be deposited (Step 920) . This information 
is transferred to the Teller money module 5 using Steps 2- 
8 for sending messages, and then Steps 7041-7050 (see 

^ Figure 38) are performed to validate the account profile 
and number. 

In the case where the depositor is a Transaction 
money module 4, the To Transaction application 49 of the 
Teller money module 5 will send an acknowledgement to the 

2Q Transaction money module 4 that the transfer of notes ll 
is ready to proceed (Step 924). Alternatively, if it is 
another Teller money module 5 that is making the deposit, 
it is the To Teller application 34 that issues the 
acknowledgement to the Teller money module 5 (Step 926) . 

2 In either case, the acknowledgement is encrypted 
and transmitted using the procedure outlined in Steps 2-8, 
whereby it is received by a To Teller application 34 of a 
depositing money module (Step 928) . 

Referring back to Figure 35, once the deposit 

2 0 request is completed, the notes 11 are transferred from 
the Teller money module B 5 to the Teller money module C 5 
using Steps 750-770, Figs. 39, 39A detailed above for 
transferring notes. Accordingly, To Bank C 47 posts the 
proper accounting transactions (see Figure 13, Step 2) to 
reflect this transfer of notes 11 (Step 908). In Teller 
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» money module C 5, the To Teller application 34 
acknowledges the deposit by sending a message back to the 
To Teller B 34 application (Steps 910-912) , using Steps 2- 
8. Naturally, the To Bank B 47 will now post its 
accounting transactions to reflect the withdrawal request 
5 it has made to Teller money module C 5 (Step 914; see also 
Fig. 13, Step 3) . 

After all electronic notes 11 have been removed 
from the Transaction money module 4 and the proper 
accounts have been posted, a withdrawal is requested of a 

1Q total amount that includes both the amount originally 
requested to be withdrawn from the subscriber's bank 
account and the amount that was removed from the 
Transaction money module 4 to be replaced with updated 
electronic notes 11. 

The withdrawal request is performed between 

15 Teller money module B 5 and Teller money module C 5 using 
the process Steps 700-724, Figs. 30, 30A, described above. 
Teller money module C 5 transacts with Money Generator 
module 6 to withdraw new electronic money and in doing so 
it establishes a session between the two modules using the 
process Steps 190-258, Figs. 34, 34A-C. 

The electronic notes 11 are requested by the 
Teller money module C 5 from the Money Generator module 6 
using process Steps 780-792, Fig. 40, and the notes 11 are- 
transferred from the Money Generator module 6 to the 

25 Teller money module C 5 using the Steps 750-770, Figs. 39, 
39A. 

The To Bank application C 47 performs the 
accounting postings (Step 916 r see also Fig. 13, Step 4). 
After this, the electronic notes 11 are transferred from 
30 Teller money module C 5 to Teller money module B 5 using 
the Steps 750-770? the notes 11 are than transferred to 
Transaction money module A 4 also using Steps 750-770. 
To finalize the withdrawal from the 
35 Correspondent Bank 2, each money module must commit to the 
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. transaction it has just had with the corresponding money 
module. Thus, Transaction money module A 4 commits to 
Teller money module B 5 using Steps 690-698, Fig. 41, and 
thereafter Teller money module B 5 commits to Teller money 
module C 5. Finally, Teller money module C 5 commits to 

t the Money Generator module 6, using the same process Steps 
690-698. 

Deposit To An Issuing Bank 

Referring to Figure 42 in combination with 
Figure 43, an example of a deposit to an Issuing Bank 1 
will now be described in detail. To start the 
transaction, a deposit set up must be done which uses the 
process steps shown in Figure 43. 

In Step 398 at the top of Figure 43, the 
subscriber decides to deposit some money to a bank. After 
performing the sign-on routine for a Transaction money 
module 4 (following Steps 10-42, Figs. 31-31A) , the To 
Subscriber A 33 prompts the subscriber for the transaction 
desired (Step 400) . 

In this example, the subscriber chooses the 
deposit transaction, the amount to be deposited, and the 
bank and account number in which to deposit the electronic 
money (Step 402). Before any other procedures, Note 
Directory A 39 checks to see if the money module contains 
funds sufficient to support the deposit request (Step 
404) . 

Assuming there are insufficient funds for the 
deposit, To Subscriber A 33 prompts the subscriber for a 
new amount (Step 410) and if no new amount is selected, 
the Session Manager A 31 informs the subscriber that the 
transaction must be terminated (Step 414) . If the 
subscriber enters a new amount. Step 412, the process flow 
returns to Step 404, wherein the Note Directory 39 
application again checks for sufficient funds for the 
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Assuming there are adequate funds within the 
money module, the process flow advances to the Network 25 
sign-on procedures outline in Steps 50-168, Figs. 33-33A. 
A successful Network 25 sign-on then advances the process 
flow to Steps 190-258, for establishing a session between 

5 the Transaction money module A 4 and Teller money module B 
5. 

Once the session is established between the two 
money modules, the deposit request steps outlined in 
procedures 920-928 are followed conveying the request from 

10 Transaction money module A 4 to the Teller money module B 
5. The To Teller A 34 transfers all of the electronic 
notes li stored within the money module to the Teller 
money module B 5 (Step 408) using the Steps 750-770 
described above for transferring electronic notes 11 

^ between two money modules. 

Continuing with Figure 42, the To Bank B 47 
posts the accounting transactions for the notes deposited 
(Step 418, see Fig. 12 Step 1). In Teller money module B 
5, the To Transaction application 49 checks to see if the 

20 amount deposited is less than the total notes 11 that were 
stored in module A and then transferred to the Teller 
money module 5 (Step 420) . If the deposit is less than 
the total amount of transferred notes 11, updated notes 11 
must be generated and sent back to the Transaction money 
module 4. 

When all the notes that are contained in the 
Transaction money module 4 are deposited, i.e. , the amount 
to be deposited is not less than the total amount of 
electronic notes 11, the To Transaction B 49 will send an 
30 acknowledgement to the Transaction money module 4 (Step 
428) using the Steps 2-8 for sending messages between 
money modules. The To Teller A 34 receives the 
acknowledgement (Step 430) and initiates the Steps 690-698 
to commit the deposit transaction between the two money 
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, modules. 

When the electronic notes 11 removed exceed the 
desired deposit amount, new updated notes 11 must be 
returned to the Transaction money module 4. To perform 
this, the To Bank application B 47 of the Teller money 
module B 5 posts the proper accounting transactions (Step 
424; Pig. 12, Step 2). Thereafter, Teller money module B 
5 establishes a session with the Money Generator module 6 
using process Steps 190-258, and requests electronic notes 
11 from the Money Generator module 6 in the amount that 
should be returned to the Transaction money module 4, by 
performing steps 780-792. 

The electronic notes ll are created by the Money 
Generator module 6 and transferred to the Teller money 
module B 5 using Steps 750-770. With the electronic notes 
11 in the possession of the Teller money module B 5, they 
are transferred to the Transaction money module A 4 using 
Steps 750-770. 

After Transaction money module A 4 receives the 
electronic notes 11, it must finalize the transaction by 
committing Teller money module B 5 to Transaction money 
module A 4 using Steps 690-698. Likewise, Teller money 
module B 5 must commit to the Money Generator module 6 
using the same Steps 690-698. 

Deposit To A Correspondent Bank 

Figure 45 illustrates the process flow for a 
deposit at a Correspondent Bank. In depositing to a 
Correspondent Bank 2, the deposit set up described in 
Steps 398 through 414 are repeated in the first stage of 
the transaction. From there the To Transaction B 49 tests 
to see if the deposit is less than the total amount of 
electronic notes 11 that have been withdrawn in the 
deposit set up procedures that were just processed (Step 
440) . 
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In the case where all the electronic notes 11 
stored in the Transaction money nodule 4 are equal to the 
amount of notes 11 to be deposited, then To Transaction B 
49 sends a deposit acknowledgement back to the Transaction 
money module 4 (Step 444) , using Steps 2-8 to send the 
5 message from the Teller money module B 5 to Transaction 
money module A 4. 

On the Transaction money module 4 side, the To 
Teller 34 application receives the acknowledgement (Step 
446) and uses Steps 690-698 to commit the transaction with 
10 Teller money module B 5. The Transaction money module 4 
is now finished and removed from the process. The 
finalization of the deposit provides for the account 
posting transactions to he made by the To Bank application 
47 (Step 448) - See Figure 11, Step 1 for the accounting 
15 transactions. 

A sessions is now established between the Teller 
money module B 5 and Teller money module C 5 using Steps 
190-258 . 

Teller money module B 5 issues a request to make 
20 a deposit to the Teller money module C 5 by using process 
Steps 780-792. The To Bank B 47 then posts the accounting 
transactions (Step 450; see also Fig. 11, Step 2). 

Notes. 11 are now transferred from the 
Correspondent Bank B 2 to the Issuing Bank C 1 using Steps 
25 750-7707 the Issuing Bank C 1 posts the corresponding 

accounting transactions (Step 452; see also Fig. 11, Step 
2) . The To Teller C 34 responds by sending the deposit 
acknowledgement (Step 454) using Steps 2-8, to To Teller 
application 34 of Teller money module B 5 (Fig. 45A, Step 
30 456). 

Here again, the deposit is checked to see if it 
is less than the amount of electronic notes 11 that have 
been removed earlier, and when it is not, the withdrawal 
is completed with the process Steps 690-698, Fig. 41, to 
35 commit Teller money module B 5 to Teller money module C 5. 
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A deposit request that is less than the amount 
of notes 11 that are withdrawn requires account updating 
(Step 460; see also Fig- 11, Step 3) , and new notes 11 to 
replace the additional notes ll that were taken. 
Accordingly, a withdrawal request following the process 
5 Steps of 920-928 from Teller money module B 5 to Teller 
money module C 5 is made to provide these new electronic 
notes XI. 

Teller money module C 5 must first establish a 
session with the Money Generator module 6, using the 
10 process Steps 190-258. The new electronic notes 11 are 
requested by the Teller money module C 5 from the Money 
Generator module 6 following process Steps 780-792, which 
are then transferred to the Teller money module C 5 using 
Steps 750-770 to transfer notes 11 between money modules. 

15 This transfer of electronic notes ll to the 

Teller money module C 5 requires that accounting 
transactions be posted by the To Bank application C 47 
(Step 462, Pig. 45B; see also Pig. 11, Step 3). 

From there, the notes 11 are transferred from 

20 the Issuing Bank's 1 Teller money module C 5 to the 

Correspondent Bank's 2 Teller money module B 5 and to the 
Transaction money module 4 by using steps 750-770 for 
transferring notes 11. Thereafter, each money module must 
commit to the money module with which it has established a 

25 session. Thus, Transaction money module A 4 commits to 
Teller money module B 5, Teller money module B 5 
subsequently commits to Teller money module C 5, which 
then commits to the Money Generator module 6. All three 
of these commitment transactions use process Steps 690-698 

30 above. 

Subscriber To Subscriber Payment 

Figure 36 illustrates the process flow for a 
35 payment transaction from one Transaction money module 4 to 
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° another. In this example of a preferred embodiment, Alice 
(or a hypothetical payor corporation, is denoted "A" in 
Figure 36) will agree to pay Bob (or a hypothetical payee 
corporation, is denoted "B- in Figure 36) a specific 
amount of electronic money (Step 800). Both Alice and 
5 Bob sign on to their respective Transaction money modules 
4 using the process Steps 10-42 described above. Through 
the To Subscriber A 33 application, Alice directs her 
Transaction money module 4 to make a payment (Step 806 & 
810) , while Bob operates his Transaction money module 4 

10 such that the To Subscriber B 33 application will issue an 
entitlement to receive payment (Step 808 & 812) . 

In Steps 814 & 816 the Session Managers 31 of 
both Alice's Transaction money module 4 and Bob's 
Transaction money module 4 established communications. 

15 From there a session is established, as described in Steps 
190-258 above for transacting between any two money 
modules. 

With a session established. To subscriber A 33 
prompts the subscriber to enter the amount of payment that 

20 she desires to transfer (Step 818), which is displayed to 
the subscriber. 

Alice enters the amount that she wishes to 
transfer to Bob. Pay/Exchange application A 35 receives 
the amount entered (Fig. 36, Step 820) . The amount 

25 entered by type (currency or credit) is now compared by 
Note Directory A 39 to the balance of the value of the 
electronic money stored in the Transaction money module 4, 
to see if there are sufficient funds available to permit 
the transaction to proceed (Step 822) . 

30 if there are insufficient funds. To Subscriber A 

33 sends the subscriber a notice that there are not 
sufficient funds to cover the transaction desired (Steps 
824-826) , and prompts the subscriber again for a new 
amount of payment (Step 827). If the subscriber prefers 

35 not to enter a new amount, the abort transaction process 
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> Steps 500-524 are activated to terminate the 
communications link between the two Transaction money 
modules 4. On the other hand, a newly entered amount will 
return the process to Step 820, to check for sufficient 
funds again. 

When there are sufficient funds stored in 
Transaction money module A 4 to process the transfer, 
Pay/Exchange A 35 sends a message disclosing the amount of 
the transfer to Bob's Transaction money module 4 (Step 
828), using the process disclosed in Steps 2-8. See Fig. 
10 36A. From there, To Subscriber B 33 prompts the owner to 
verify that the amount to be transferred will be accepted 
by him (Step 830) . Bob can then decide whether to accept 
or reject the amount to be transferred (Step 832) . 

If Bob responds in the negative, then 
15 Pay/Exchange B 35 will send a message back to Transaction 
money module A 4 using Steps 2-8, that the amount to be 
transferred is incorrect (Step 834) ; the process again 
returns to Step 826, Fig. 36, to prompt Alice for a new 
amount to be entered. 
2 0 When Bob responds in the affirmative in Step 

832, Pay/ Exchange B 35 will send an acknowledgement to 
Transaction money module A 4 using Steps 2-8 (Step 835) . 
Back in Transaction money module A 4, the message will be 
conveyed to Pay/Exchange A 35 to receive the 
25 acknowledgment sent by Transaction money module B 4 (Step 
836). 

With this acknowledgement received, Pay/Exchange 
A 35 will send the amount desired to be transferred to the 
Money Holder 38 (Step 838) so that the electronic notes 11 
3Q may be transferred using Steps 750-770. With the transfer 
completed, the two Transaction money modules 4 must commit 
to the transfer using Step 690-698 described above. The 
communication link between the two transaction modules may 
now be terminated. 

35 
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Subscriber to Subscriber Foreign Exchange 

Referring to Figure 46, the process flow for an 
exchange of foreign currencies between two Transaction 
money nodules 4 will now be illustrated. In this example 
s Alice (or a hypothetical corporation, denoted "A" in 
Figures 46-46A) agrees to exchange dollars for pounds with 
Bob (or a hypothetical corporation, denoted »B" in Figures 
46-46A) . The exchange rate that they have agreed to will , 
be a ratio of dollars to pounds (Step 300) . 

Alice begins by signing on to her Transaction 

10 money module 4 (using Steps 10-42 described above) while 
Bob signs on to his Transaction money module 4 (using 
Steps 10-42). Thereafter, the To Subscriber 33 
applications of both Transaction money modules 4 prompt 
the respective users to select a type of transaction 

15 (Steps 302-303). In this example, Alice and Bob agree to 
exchange her dollars for his pounds. 

By requesting the foreign exchange transaction, 
session Manager A 31 will establish a communications link 
with session Manager B 31 (Steps 306, 307) so that a 

20 session may be established between the two money modules 
using Steps 190-258. Alice is then prompted by To 
Subscriber A 33 for the amount of dollars she will sell, 
and the exchange rate that she will use in the transaction 
(Step 308). 

Pay/Exchange A 35 receives the input (Step 310) 
and Note Directory A 39 checks for sufficient funds by 
comparing the amount requested to the amount of value 
contained in the Transaction money module 4 (Step 312) . 
An insufficient funds condition will cause the To 
30 subscriber A 33 to send an insufficient funds message to 
Alice and prompt the subscriber to select another amount 
of dollars and exchange rate (Steps 318-320) . When new 
selections are entered, the process flow returns to Step 
312 and continues from there. If Alice does not select a 
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« new amount, -the session is dissolved using abort 
transaction Steps 500-524. 

When the funds are sufficient to meet the amount 
requested, the Pay/Exchange A 35 sends the amount of the 
dollars and the proposed dollar/pound exchange rate (Step 
5 316) to the To Subscriber application 33 of Transaction 
money module B 4 using the steps 2-8. (See Figure 46A) . 
At this point. To subscriber B 33 prompts Bob with the 
amount and rate proposed by Alice, to determine if the 
values are what Bob will agree to exchange (Step 322). 
10 The Pay/Exchange B 35 receives the dollar amount 

and the rate that is proposed by Alice and if the amount 
and rate are not agreed to by Bob, Pay/Exchange B 35 will 
send a message indicating that the value or exchange rate 
is incorrect (Step 326) , through the Steps of 2-8 for 
sending messages. To Subscriber A 33 prompts Alice for 
the dollar amount and exchange rate over again (Step 327) . 
Entry of new values returns the process to step 310 for 
continuation, see Fig. 46, while the lack of new values 
entered causes the abort transaction process of Steps 500- 
2Q 524 to be initiated. 

If the amount and rate are agreed to by Bob, 
Pay/Exchange B 35 will calculate the equivalent amount in 
pounds, based on the rate provided (not shown) , and then 
initiate the step of having Note Directory B 39 check to 
25 see that Transaction money module B 4 contains sufficient 
funds to fulfill the exchange (Step 323). When the funds 
in Transaction money module B 4 are insufficient to meet 
the exchange, Pay/Exchange B 35 sends a message to Alice 
of insufficient funds (Step 325) using Steps 2-8. The 
30 process flow returns to Step 327. 

Proceeding with the case in which sufficient 
funds do exist in Transaction money module B 4, 
Pay/Exchange B 35 will send an acknowledgement using Steps 
2-8 to Transaction money module A 4 (Step 329) . After 
25 receiving this acknowledgement, Pay/Exchange A 35 sends 
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" the amount of dollars requested to its corresponding Money 
Holder 38 application in Step 330. The dollars are 
transferred from Alice to Bob via the Steps 750-770 
described above for transferring notes 11. 

Pay/Exchange B 35 receives the notes 11 and then 
5 transfers the amount of pounds to its Money Holder 38 

application (Step 331) . From there, the electronic pounds 
are transferred to Alice using the transfer notes process 
described in Steps 750-770. To record this exchange. 
Transaction money module A 4 commits with Transaction 
10 money module B 4 by using process Steps 690-698 described 
above. With a satisfactory exchange, the communications 
link between the two Transaction money modules may now be 
terminated. 

15 Foreign Exchange At An Issuing Bank 

Turning attention now to Figure 48, if a 
subscriber were to exchange his/her dollars for pounds 
with an Issuing Bank 1 instead of with a subscriber, the 

20 following process is followed. 

Subscriber A sets up the foreign exchange 
transaction by signing on to his/her Transaction money 
module 4 (see Fig. 47Z) using Steps 10-42 described above. 
To Subscriber A 33 prompts the subscriber for the 

25 transaction desired (Step 334) , and in this example, the 
subscriber chooses the dollar/pound exchange, and the 
amount of dollars the subscriber will exchange. It is 
anticipated that the choice of the bank to transact with 
may be an option offered to the subscriber (Step 336) . 

30 The Note Directory A 39 checks for a sufficient 

balance to complete the request (Step 338) . An 
insufficient balance permits the subscriber to again enter 
the amount he/she will exchange (Step 340-342) , whereby 
Session Manager A 31 will terminate the transaction (Step 

35 345) if no new amount is entered. Entry of a new amount 
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returns the process to Step 338 to check for sufficient 
funds to meet the new request. When the funds are 
sufficient for the exchange request, a Network 25 sign-on 
using Steps 50-168 is commenced. 

After the Network 25 sign-on, the Network 25 
5 checks if a bank or financial institution has been 

selected (Step 346) . If a bank or financial institution 
was not chosen earlier, To Teller A 34 must prompt the 
Network Server 26, through Session Manager A 31, for a 
list of banks or financial institutions that will provide 
10 the exchange (Steps 348-350) . The Network Server 26 sends 
the list (along with rates) to the subscriber through the 
To Teller A 34 and To Subscriber A 33 applications (Steps 
352-356). 

After prompting (Step 357, Fig. 47A) , the 
15 subscriber chooses a bank or financial institution, or 

ends the transaction (Step 359). When a bank or financial 
institution is chosen, a session is established with the 
Teller money module 5 chosen using Steps 190-258 described 
above. After a session is established, To Teller A 34 
20 sends the amount of dollars to be exchanged for pounds 

(Step 360) using Steps 2-8 for encrypting and transmitting 
a message. 

To ensure that the subscriber still wants to 
proceed with the exchange, To Transaction B 49 sends the 

25 current exchange rate to the subscriber using process 
Steps 2-8 (Step 362). At this point, To Subscriber A 33 
prompts the subscriber with the bank's exchange rate and 
if the subscriber does not wish to proceed, the 
transaction is aborted by following Steps 500-524 (Steps 

30 364-366) . If the transaction is to proceed, the dollars 
are transferred from Transaction money module A 4 to 
Teller money module B 5 using Steps 750-770 described 
herein. 

Returning to Figure 48, once the set up of the 
35 foreign exchange transaction is accomplished, the proper 
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" accounting transactions are posted (Step 368; also 

illustrated in Figure 15, Step 1) to reflect the dollars 
that have just been transferred. A session is established 
between Teller money module B 5 and a Money Generator 
module 6 via Steps 190-258. Teller money module B 5 
5 requests the proper pound notes 11 through process Steps 
780-792. The notes 11 are returned from the Money 
Generator module 6 to the Teller money module B 5 using 
Steps 750-770. 

This latter transfer of notes 11 requires a 

10 corresponding updating of the accounts involved (Step 370; 
see also Pig. 15, Step 2) . The notes 11 are transferred 
to the Transaction money module A 4 through process Steps 
750-770. To complete the exchange, Transaction money 
module A 4 commits to Teller money module B 5 who 

15 subsequently commits to the Money Generator module 6 using 
process Steps 690-698. 

Foreign Exchange At A Correspondent Bank 

20 The foreign exchange with a correspondent Bank 2 

is described with the aid of Figure 49. Initially, the 
foreign exchange transaction is set up by repeating 
process Steps 334-366, (Figs. 47-47A) and updating the 
proper accounts (see Figure 16, Steps 1-2) to reflect the 

25 notes 11 that have just been transferred from the 

subscriber's money module 4 to Teller money module B 5 
(Step 372) . Thereafter, Teller money module B 5 will 
establish a session with Teller money module C 5 at an 
Issuing Bank 1, by performing process Steps 190-258. 

30 A withdrawal is requested by Teller money module 

B 5 to Teller money module C 5 using process Steps 920-928 
described above. To obtain the notes 11 for the request, 
Teller money module C 5 must get them from a Money 
Generator module 6. Accordingly, a session is established 

35 between the two money modules via Steps 190-258, and the 
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notes IX are requested following process Steps 780-792 
outlined above. 

The Money Generator nodule 6 will create the 
notes 11 requested and transfer them to Teller money 
module C 5 using process Steps 750-770. This is followed 
5 by a posting to the proper accounts in the (bank's systems 
(Step 374), see Figure 16, Step 3 for accounting 
transactions) . The notes 11 are now transferred from 
Teller money module C to Transaction money module A 4 via 
Teller money module B S using for each transfer the 

10 process Steps 750-770. Finally, all the sessions must be 
committed, and Transaction money module A 4 commits to 
Teller money module B 5 who in turn commits to Teller 
money module C 5 using Steps 690-698. Teller money module 
C 5 commits to the Money Generator module 6 to complete 

15 the exchange of dollars for pounds. 

Updating Notes, Certificate 

As mentioned above, it is anticipated that the 

20 date of expiration of a note, used as a security measure, 
may expire while it is stored in a Transaction money 
module 4. If this occurs, the holder of expired notes ll 
will not be able to transfer them to another Transaction 
money module 4, but the holder may deposit them or 

25 exchange them for new notes 11 by transacting with a 
participating bank or financial institution. 

Additionally, if the certificate associated with 
a particular Transaction money module 4 expires, the 
subscriber must sign on the Network 25 to update the 

30 certificate in order to transact with another Transaction 
money module 4. The following is a description of the 
process flow for updating an expired certificate or 
expired notes 11. 

Beginning at the top of Figure 50, a subscriber 

35 signs on to the Transaction money module 4 using the Steps 
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33 to select a transaction (Step 570) . After selecting 
the transaction for "updating" (Step 572) , a sign-on to 
the Network 25 is performed using Steps 50-168. The sign- 
on to the Network 25 will perform the updating of the 
certificate, as described above with reference to Figure 

i 

33-33A. 

For updating the notes 11, the session Manager A 
31 sends the update notes request to the Network 25 (Step 
574) ; the Network Server 26 responds by sending the 
selected bank identifier back to the Transaction money 
* module 4 (Step 576) . Now, a session may be established 
between the Transaction money module A 4 and the Teller 
money module B S of the bank selected, using Steps 190- 
258. 

Once the session is established, To Teller A 34 

' sends the request to update notes 11 (Step 578) using the 
message sending routine in Steps 2-8. To Transactor B 32 
responds, Fig. 50A, with an acknowledgement (Step 580) 
sent using Steps 2-8. Transaction money module A 4 can 
now transfer the expired notes 11 to Teller money module B 

} 5 using Steps 750-770. Thereafter, the corresponding 
accounting (see Figure 24, Step 1) is performed in the 
bank's records (Step 582), and a session is established 
between Teller money module B 5 and the Money Generator 

. module 6 through Steps 190-258. 

The request notes routine of Steps 780-792 is 
then performed. The Money Generator module 6 sends the 
requested notes 11 via Steps 750-770, and updates the 
accounts at the bank (Step 584; see also Fig. 24, Step 2). 
Teller money module B 5 takes the updated notes 11 and 

5 passes them to Transaction money module A 4 using the same 
Steps 750-770. 

Now that the notes 11 have been updated in the 
Transaction money module 4, the sessions are completed by 
having Transaction money module A 4 commit to Teller money 



PCI7US92/09732 



-"101 - 

o nodule B 5, and having Teller money nodule B 5 then commit 
the transaction with the Money Generator module 6. 
Finally, both committing routines are performed using 
Steps 690-698 described above. 

The above described process flows illustrate the 

5 capability of the invention to provide an improved system 
for exchanging electronic representations of economic 
value, while avoiding the inherent limitations of paper 
based monetary systems. 

Operation of the invention has been described 

0 primarily with currency notes and credit notes that can be 
used by subscribers in the same processes. It will be 
understood that the described system can also be adapted 
to other monetary instruments. For example, personal and 
corporate checks and bank drafts could be provided by 

5 enhancing several of the Transactor applications. More 
complicated multiparty payment processes such as letters 
of credit and banker's acceptances could also be provided 
with appropriate changes to the system. It may also be 
possible to adapt the system of the invention to provide 

Q corporate financial obligations such as commercial paper. 
Moreover, although the invention has been 
described in detail with particular reference to a 
preferred embodiment thereof, it should be understood that 
the invention is capable of other and different 

5 embodiments, and its details are capable of modifications 
in various obvious respects. As is readily apparent to 
those skilled in the art, variations and modifications can 
be affected while remaining within the spirit and scope of 
the invention. Accordingly, the foregoing disclosure, 

, 0 description, and figures are for illustrative purposes 
only, and do not in any way limit the invention, which is 
defined only by the claims. 
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1. An electronic monetary system for providing 
transactions utilizing electronic representations of 

r backed by demand deposits in a bank comprising: 

means for generating said electronic 
representations of currency; 

teller means for issuing and 
distributing said electronic 
representations of currency; 

transacting means for storing, and for 
transferring said electronic 
representations of currency between 
other transacting means and between 
said transacting means and said teller 



2. An electronic monetary system for providing 
transactions utilizing electronic representations of 
credit authorizations comprising: 

means for generating said electronic 
representations of credit; 

teller means for issuing and 
distributing said electronic 
representations of credit; 

transaction means for storing, and for 
transferring said electronic 
representations of credit between 
other transacting means and between 
said transacting means and said teller 
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3. An electronic monetary system according to 
claim 1 or claim 2 further comprising a means for 
maintaining the security and integrity of said electronic 

5 monetary system. 

4. An electronic monetary system according to 
claim 1 or claim 2 further comprising a means for 
providing a communication network between said generating 

10 means, said teller means, said transacting means, and said 
security means. 



5. An electronic monetary system according to 
claim 1 or claim 2 further comprising a means for 

15 maintaining and processing account data files for storing 
records of said electronic representations of currency or 
credit issued by said generating means and records of said 
electronic representations of currency or credit 
transferred by said transacting means to said teller 

20 means. 



6. An electronic monetary system according to 
claim 3 wherein said security means further comprises a 
time limit on the transferability of said electronic 
25 representations of credit and said electronic 

representations of currency among said transacting means. 



7 . An electronic monetary system according to 
claim 3 wherein said generating means, said teller means 

30 and said transacting means each comprise an individual 

identifier, and said means for maintaining the security of 
said electronic monetary system further comprises a 
certification means for providing a unique certificate of 
said identifier of each of said generating means, said 

35 teller means and said transacting means. 
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8. An electronic monetary system according to 
claim 7 wherein said certificate further comprises a time 
limit on its acceptability by said generating means, said 
teller means or other of said transacting means. 

9. An electronic monetary system according to 
claim 1 or claim 2 wherein said generating means further 
comprises a public key digital forming means for forming a 
digital signature on said electronic representations of 
currency or said electronic representations of credit. 

10. An electronic monetary system according to 
claim 1 or claim 2 wherein said teller means further 
comprises a public key digital forming means for forming a 
digital signature on said electronic representations of 
currency or said electronic representations of credit. 

11. An electronic monetary system according to 
claim 1 or claim 2 wherein said transacting means further 
comprises a public key digital forming means for forming a 
digital signature on said electronic representations of 
currency or said electronic representations of credit. 

12. An electronic monetary system according to 
claim 1 or claim 2 wherein said electronic representations, 
of currency or said electronic representations of credit 
are undeniably acceptable as economic value. 

13. An electronic monetary system according to 
claim 1 or claim 2 wherein said electronic representations 
of currency or said electronic representations of credit 
are commutable and transferrable in values less than or 
equal to their original economic value when generated. 

14. An electronic monetary system according to 
claim 13 wherein said electronic representation of credit 
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is transferable only one time by said transacting means. 



15. An electronic monetary system according to 
claim 1 or claim 2 wherein said electronic representations 
of currency or said electronic representations of credit 
further comprise indicia of 

(1) whether said representation is a currency 
or a credit representation, 

(2) its said time limit of transferability, and 

(3) its economic value. 

16. An electronic monetary system according to 
claim 15 wherein said indicia further comprise indicia of 

(1) said certificates of said other transacting 



(2) said certificates of said teller means, and 

(3) said certificate of said generating means. 

17. An electronic monetary system according to 
claim 16 wherein said indicia further comprise indicia of 
(1) a digital signature of said generating 



(2) a digital signature of said teller means, 
and 

(3) a digital signatures of said other 
transacting means. 



18. An electronic monetary system according to 
claim 1 or claim 2 wherein said generating means, said 
teller means, and said transacting means are each 

30 comprised of a programmable processing device contained in 
a tamper-proof housing. 

19. An electronic monetary system according to 
claim 18 wherein said generating means, said teller means, 

35 and said transacting means are configured to perform as a 
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modular co-processor of a general purpose computer. 

20. An electronic monetary system according to 
claim 18 wherein each of said programmable processing 
devices further comprises a list of other offending 

5 programmable processing devices. 

21. An electronic monetary system according to 
claim 1 or claim 2 further comprising a means for clearing 
said electronic representations of credit and currency 

10 issued by more than one bank. 

22. An electronic monetary system according to 
claim 1 or claim 2 wherein said financial facilities 
further comprise an accounting structure to monitor the 

15 distribution of said electronic representations of 

currency or said electronic representations of credit and 
each financial facility's obligation after any financial 
transaction. 

20 23. An electronic monetary system according to 

claim 18 wherein said programmable processing device in 
said transacting means further comprises separate lists 
for accounts associated with the owner of said transacting • 
means that are held at each of said different financial 

25 facilities. 

24. An electronic monetary system according to 
claim 23 wherein each of said list of accounts further 
comprises a digital signature of the financial facility 
30 maintaining said accounts, to provide security from 
unauthorized access of said accounts. 



35 



25. An electronic monetary system according to 
claim 1 or claim 2 wherein said generating means is 
configured to generate said electronic representations of 
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currency or said electronic representations of credit for 
a plurality of monetary units. 

26. An electronic monetary system according to 
claim 18 wherein each of said programmable processing 
devices can be personally coded to prohibit use by 
unauthorized persons, such coding being performed by an 
individual that does not have any relationship with any of 
said financial facilities, and whose identity remains 
anonymous . 

27. A monetary system using electronic 
representations of money and including at least one 
financial facility and subscribers served by said 
facility, said system comprising: 

a plurality of subscriber processors, 
each adapted to contain said 
electronic representations in the form 
of machine readable digital objects 
containing data indicative of the 
monetary value represented and the 
current validity of said 
representations ; 

processing means operated by said 
financial facility and capable of 
communicating with said subscriber 
processors for the deposit in said 
facility of representations stored in 
said subscriber processors, or the 
withdrawal or representations from 
said facility to said subscriber 
processors ; 



35 



said subscriber processors also 
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° including communication and processing 

functions enabling exchange of said 
representations between subscriber 
processors. 

5 28. A system according to claim 27 in which 

said money representations are configured to be 
functionally equivalent to bank notes. 

29. A system according to claim 27 including a 
10 certification source enabling the processing of said 

representations to indicate their validity. 

30. A system according to claim 27 in which 
there are a plurality of said financial facilities and a 

15 clearing facility for clearing transactions among said 
financial facilities and said subscriber processors. 

31. A system according to claim 27 in which 
said data stored in said subscriber processors includes 

20 data representations for ascertaining the status of said 
representations . 

32. A system according to claim 27 in which 
said electronic representations of money stored in said 

25 subscriber processors are replaced with updated 

representations during transactions with said financial 
facility. 

33. A monetary system using electronic media to 
30 securely and reliably exchange economic value, said 

monetary system comprising: 



35 



electronic representations of credit 
authorizations and electronic 
representations of currency backed by 
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* demand deposits in a bank; 

means for generating said electronic 
representations of credit and said 
electronic representations of 
5 currency; 

teller means coupled to said 
generating means for issuing, 
distributing, and accepting said 
10 electronic representations of credit 

and currency? and 

transacting means for storing, and for 
transferring said electronic 
15 representations of credit and currency 

with other transacting means and 
between said transacting means and 
said teller means. 

20 34. A monetary system according to claim 33 

further comprising a means for transmitting said 
electronic representations in a secure manner between said 
generating means, said teller means and said transmitting 
means to maintain the security and integrity of said 

25 monetary system. 

35. A monetary system according to claim 34 
wherein said security means further comprises a time limit 
on the transferability of said electronic representations 

30 of credit and currency among said transacting means. 

36. A monetary system according to claim 34 
wherein said generating means, said teller means and said 
transacting means each comprise an individual identifier, 

35 and said means for maintaining the security of said 
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monetary system further comprises a certification means 
for providing a unique certificate of said identifier of 
each of said generating means, said teller means and said 
transacting means. 

5 37. A monetary system according to claim 36 

wherein said certificate further comprises a time limit on 
its acceptability by said generating means, said teller 
means or other of said transacting means. 

1Q 38. A monetary system according to claim 34 

further comprising a networking means for providing a 
communication link between said generating means, said 
teller means, said transacting means, and said security 
means . 

15 

39. A monetary system according to claim 33 
wherein said generating means is configured for generating 
said electronic representations of credit and currency for 
a plurality of monetary units. 

20 

40. A monetary system according to claim 33 
wherein said electronic representations of credit and 
currency are undeniably acceptable as economic value, and 
are commutable and transferrable in values less than or 

25 equal to their original economic value. 

41. A monetary system according to claim 40 
wherein said electronic representation of credit is 
transferable only one time by said transacting means. 

30 

42. A monetary system according to claim 33 
wherein said generating means further comprises a public 
key digital forming means for forming a digital signature 
on said electronic representations of credit and currency. 



35 
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43. A monetary system according to claim 33 
wherein said teller means further comprises a public key 
digital forming means for forming a digital signature on 
said electronic representations of credit and currency. 

44. A monetary system according to claim 33 
wherein said transacting means further comprises a public 
key digital forming means for forming a digital signature 
on said electronic representations of credit and currency. 

45. A monetary system according to claim 41 
wherein said electronic representations of credit and 
currency comprise indicia of 

(1) whether said representation is a currency 
or a credit representation, 

(2) its said time limit of transferability, 

(3) its economic value, 

(4) said digital signature of said generating 
means , 

(5) said digital signatures of said teller 



(6) said digital signatures of other 
transacting means, 

(7) said certificates of other transacting 



(8) said certificates of said teller means, 

(9) said certificate of said generating means, 
and 

(10) an identifier of said electronic 
representation of currency or credit. 



30 



46. A monetary system according to claim 3 3 
wherein said generating means, said teller means, and said 
transacting means are each comprised of a programmable 
processing device contained in a tamper-proof housing. 

35 
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« 47. A monetary system according to claim 46 

wherein said generating means, said teller means, and said 
transacting means are configured to perform as a modular 
co-processor of a computer. 

5 48. A monetary system according to claim 33 

further comprising a means for clearing said electronic 
representations of credit and currency issued by more than 
one bank. 

1Q 49. A method of using electronic 

representations of currency or electronic representations 
of credit provided by at least one financial facility 
having a means for generating said electronic 
representations, and a teller means for issuing and 

15 accepting said electronic representations and serving 
subscribers of said facility, comprising the steps of: 

generating said electronic representations 
of currency backed by demand deposits or 
generating said electronic representations 
of credit authorizations; 

issuing to said subscribers and accepting 
from said subscribers electronic 
representations of currency or credit, 
wherein the issuance and acceptance is 
performed by said teller means at said 
financial facility; and 

providing said subscribers with a 
transacting means for accepting said issued 
electronic representations of currency or 
credit, and for transferring said 
electronic representations of currency or 
credit to both other subscribers having 



(1) 



(2) 
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said transacting means, and to said teller 
means . 



50. The method of claim 49 further comprising 
the step of digitally signing said electronic 
5 representations of currency or credit to provide 
authenticity and security from duplication or 
modification . 



51. The method of claim 50 further comprising 
10 the step of limiting the time period that said electronic 

representations of currency or credit may be transferred 
among said transacting means. 

52. The method of claim 51 further comprising 
15 the step of removing all of said electronic 

representations of currency stored in said transacting 
means whenever said transacting means transacts with said 
financial facility, the step of generating new electronic 
representations of currency having a renewed time limit on 
20 transferability, and the step of replacing said original 

electronic representations of currency in said transacting 
means with said new electronic representations of 
currency. 

25 53. The method of claim 51 further comprising 

the step of removing all non- transfer red electronic 
representations of credit authorizations stored in said 
transacting means only whenever said transacting means 
transacts with the financial facility issuing said 

30 electronic representations of credit, the step of 

generating new electronic representations of credit having 
a renewed time limit on transferability, and the step of 
replacing said original electronic representations of 
credit in said transacting means with said new electronic 

35 representations of credit. 
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54- The method of claim 49 further comprising 
the steps of clearing, and maintaining records of said 
electronic representations of currency or credit issued by 
said financial facilities. 

55. The method of claim 49 further comprising 
the step of providing an identifier unique to each of said 
generating means, said teller means and said transacting 



56. The method of claim 55 further comprising 
the step of certifying for a limited period of time the 
validity of said identifier of each of said generating 
said teller means and said transacting means. 



57. The method of claim 56 further comprising 
the step of providing a list of any offending teller 
means, generating means, or transacting means to each of 
said generating means, said teller means and said 
transacting means. 

58. The method of claim 49 further comprising 
the step of generating said electronic representations of 
credit and currency for a plurality of different monetary 
units. 

59. The method of claim 49 further comprising 
the step of providing an accounting structure at said 
financial facilities to monitor the distribution of said 
electronic representations of currency or credit, and each 
financial facility »s obligation after any financial 
transaction. 

60. The method of claim 59 further comprising 
the step of storing in said transacting means separate 
lists for accounts associated with said subscriber at each 
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° of said financial facilities. 

61. The method of claim 60 further comprising 
the step of digitally signing each of said list of bank 
accounts with the digital signature of the corresponding 

5 financial facility, to provide security from unauthorized 
access of said accounts. 

62. The method of claim 55 further comprising 
the step of maintaining records of transactions undertaken 

10 by said generating means, said teller means and said 

transacting means and storing said records within each of 
said respective generating means, said teller means and 
said transacting means, wherein said transaction record 
includes indicia of the date of transfer, the amount of 

15 transfer, an identifier of the financial facility issuing 
said electronic representations of currency or credit, and 
an identifier of the electronic representation of currency 
or credit transferred. 

20 63. The method of claim 62 further comprising 

the step of maintaining copies of said electronic 
representations of currency and credit issued at said 
financial facilities, and the step of updating said copies 
upon transacting with any of said transacting means. 

25 

64. The method of claim 63 further comprising 
the step of reconciling said copies of electronic 
representations of currency and credit with electronic 
representations of currency and credit that have been 

30 cleared in said financial facilities. 

65. The method of claim 64 further comprising 
the steps of: 

(1) storing records of individual transactions 
35 that have occurred among said transacting 
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means to a separate storage means, 

(2) submitting said records of individual 
transactions stored in said storage means 
to said financial facilities when said 
electronic representations of currency or 
credit are stored in a transacting means 
that becomes lost or stolen, and 

(3) comparing said records of individual 
transactions among said transacting means 
with records produced by said 
reconciliation of said electronic 
representations of currency and credit to 
determine the true value of said electronic 
representations of currency and credit 
stored in said transacting means that may 
be lost or stolen, for accurate replacement 
of said value lost. 



66. The method of claim 49 further comprising 
the step of providing a communication network, linking 
20 together said financial facilities and said transacting 
means. 
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ELECTRONIC-MONETARY SYSTEM 
Background of fchu invention 

The present invention relates to an electronic 
monetary system for implementing electronic money payments 
as an alternative medium of economic exchange to cash, 
checks, credit and debit cards, and electronics fund 
transfer. The Electronic-Monetary System is a hybrid of 
currency, check, card payment systems and electronic funds 
transfer systems, possessing many of the benefits of these 
systems with few of their limitations. The system 
Q utilizes electronic representations of money which are 
designed to be universally accepted and exchanged as 
economic value by subscribers of the monetary system. 

Today, approximately 350 billion coin and 
currency transactions occur between individuals and 
institutions every year. The extensive use of coin and 
currency transactions has limited the automation of 
individual transactions such as purchases, fares, and bank 
account deposits and withdrawals. Individual cash 
transactions are burdened by the need of having the 
^ correct amount or providing change therefor. Furthermore, 
the handling and managing of paper cash and coins is 
inconvenient, costly and time consuming for both 
individuals and financial institutions alike. 

Although checks may be written for any specific 
. amount up to the amount available in the account, checks 
have very limited transferability and must be supplied 
from a physical inventory. Paper-based checking systems 
do not offer sufficient relief from the limitations of 
cash transactions, sharing many of the inconveniences of 
handling currency while adding the inherent delays 
associated with processing checks. To this end, economic 
exchange has striven for greater convenience at a lower 
cost, while also seeking Improved security. 

Automation has achieved some of these qualities 
for large transactions through computerized electronic 
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„ funds transfer ("EFT") systems. Electronic funds transfer 
is essentially a process of value exchange achieved 
through the banking system's centralized computer 
transactions. EFT services are a transfer of payments 
utilizing electronic "checks," which are used primarily by 
5 large commercial organizations. 

The Automated Clearing House (ACH) and point of 
sale (POS) systems are examples of electronic funds 
transfer systems that have become used by retail and 
commercial organizations on a substantial basis in recent 
years. However, the payments made through these types of 
EFT systems are limited in that they cannot be performed 
outside of the banking system. Moreover, ACH transactions 
usually cannot be performed during off business hours. 

Home banking bill payment services are examples 
15 of an electronic funds transfer system used by individuals 
to make payments. Currently, home banking initiatives 
have found few customers, of the banks that have offered 
services for payments, account transfers and information 
over the telephone lines using personal computers, less 
20 ° ne percent * of V** 1 bank's customers are using the 

service. One reason that home banking has not been a 
successful product because the customer cannot deposit and 
withdraw money as needed in this type of system. 

Current EFT systems, credit cards, or debit 
25 cards, which are used with an on-line system to transfer 
money between accounts, such as between the account of a 
merchant and that of a customer, cannot satisfy the need 
for an automated transaction system that provides for the 
transfer of universally accepted economic value outside of 
2 0 tne banking system. 

To implement an automated, yet more convenient 
transaction system that does not require the banking 
system to intermediate the transfer, and that can dispense 
some form of economic value, there has been a trend 
35 towards off-line electronic funds transfer. For example. 
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, numerous ideas have been proposed for some form of 
"electronic money" that can be used in cashless payment 
transactions as alternatives to the traditional currency 
and check types of payment systems. See U.S. Patent No. 
4,977,595, entitled "METHOD AND APPARATUS FOR IMPLEMENTING 

; ELECTRONIC CASH, and U.S. Patent No. 4,305,059, entitled. 

"MODULAR FUNDS TRANSFER SYSTEM." 

The more well known techniques include magnetic 
stripe cards purchased for a given amount and from which a 
prepaid val*e can be deducted for specific purposes. Upon 
! exhaustion of the economic val*e, the cards are thrown 
away. Other examples include memory cards or so called 
smart cards which are capable of repetitively storing 
information representing value that is likewise deducted 
for specific purposes. 

However, these proposed systems suffer from a 
failure to recognize fully the significance of bank 
deposits as money, and their necessity to back any form of 
universally accepted monetary representations that may be 
issued. In the systems disclosed thus far, 
representations of economic value, whether electronic or 
paper, are issued without the backing of equal valued 
liabilities as the counterpart to their assets. 

None of the paperless payment systems that have 
been proposed so far are comprehensive enough so as to 
implement a multipurpose electronic monetary system that 
includes not only the automated devices that allow 
subscribers to transfer electronic funds or money between 
them without any intermediating system, but that also 
encompasses and includes an entire banking system for 
generating the value represented by the electronic money 
and for clearing and settling the electronic money 
accounts of the banks and financial institutions involved 
to maintain a monetary balance within the system. 

Thus, specifically, there is a need for a system 
that allows common payor to payee transactions without the 
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o intermediation of the banking system, and that gives 
control of the payment process to the individual. 
Furthermore, a need exists for providing a system of 
economic exchange that can be used by large organizations 
for commercial payments of any size, that does not have 

^ the limitations of the current EFT systems. 

Accordingly, it is an object of the present 
invention to provide a complete electronic monetary system 
which utilizes electronic money that is interchangeable 
with traditional cash and is universally accepted. 

0 It is another object of the present invention to 

provide a method of securely transferring economic value 
including currency and credit among subscribers, among 
financial institutions, and between subscribers and 
financial institutions. 

^ A further object of the present invention is to 

provide a multipurpose paperless payment system whereby 
transactions can be carried put in both an on-line and an 
off-line mode between subscribers. 

It is yet another object of the present 

Q invention to provide a payment system that reduces the 
cost of central electronic funds transfer systems by off 
loading much of the payments to off-line devices. 

It is still another object of the present 
invention to provide a system of inexpensive electronic 

5 transfers to reduce an institution's cost of managing 
paper cash, checks and coins. 

It is still a further object of the present 
invention to provide a user friendly electronic payment 
system that may be used reliably and securely for real 

|Q time transfers of Tnoney between members of the general 
public, between members of the general public and 
commercial organizations, and between commercial 
organizations . 

It is still another object of the present 
invention to provide a system for depositing and 
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u withdrawing economic value which nay be integrated with a 
wide variety of data processing and data communication 
systems including currently available home banking 
services . 

It is still a further object of the present 
^ invention to provide an electronic monetary system which 
utilizes electronic money in the form of multiple 
currencies . 

It is yet a further object of the present 
invention to provide a system for safely transferring 
1Q economic value in transactions of virtually any size 
denomination. 

It is yet another object of the present 
invention to provide a medium of economic exchange that is 
fungible, easily transferable, undeniably redeemable, and 
^ secure from reuse, duplication, and counterfeiting. 

The foregoing objects and advantages of the 
invention are illustrative of those which can be achieved 
by the present invention and are not intended to be 
exhaustive or limiting of the possible advantages which 
2Q can be realized. Thus, these and other objects and 
advantages of the invention will be apparent from the 
description herein or can be learned from practicing the 
invention, both as embodied herein or as modified in view 
of any variations which may be apparent to those skilled 
in the art. Accordingly, the present invention resides in 
the novel methods, arrangements, combinations and 
improvements herein shown and described. 



25 



30 



Summary of Exemplary Embodiment 
To achieve the foregoing, and other objects, the 
methods and apparatus of the present invention employ a 
preferred embodiment in the form of an electronic-monetary 
system having (iy banks or financial institutions that are 
coupled to a money generator device for generating and 
35 issuing to subscribing customers electronic money 
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including electronic currency backed by demand deposits 
and electronic credit authorizations; (2) correspondent 
banks that accept and distribute the electronic money; (3) 
a plurality of transaction devices that are used by 
subscribers for storing electronic money, for performing 
money transactions with the on-line systems of the 
^ participating banks or for exchanging electronic money 
with other like transaction devices in off-line 
transactions; (4) teller devices, associated with the 
issuing and correspondent banks, for process handling and 
interfacing the transaction devices to the issuing and 

10 correspondent banks, and for interfacing between the 

issuing and correspondent banks themselves; (5) a clearing 
bank for balancing the electronic money accounts of the 
different issuing banks; (6) a data communications network 
for providing communications services to all components of 

15 the system; and (7) a security arrangement for maintaining 
the integrity of the system, and for detecting 
counterfeiting and tampering within the system. 

In the preferred embodiment the functions of the 
money generating devices, the transaction devices, and the 

20 teller devices will be performed by a combination of 
tamper-proof computer hardware and application software 
modules that may be networked together. Information is 
transmitted in an encrypted form to provide security from 
unauthorized inspection. The electronic money is 

25 transmitted with digital signatures to provide 
authentication, and security from modification or 
counterfeiting. 

The electronic money exchanged by these devices 
may be an electronic representation of currency or credit. 

30 An important aspect of the electronic currency is that it 
is the equivalent of bank notes and is interchangeable 
with conventional paper money through claims on deposits 
in an issuing bank, but can be withdrawn or deposited both 
at an issuing bank and at a correspondent bank. However, 

35 
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„ only the issuing banks can generate the electronic 
currency, and will be liable for its redemption. 

The issuing banks later utilize inter-bank 
clearing and settling processes to maintain the monetary 
balance in the banking system, as is currently practiced 
by today's banking industry. 

The electronic money representations are 
fungible, universally accepted, and undeniably redeemable 
from the issuing banks, i.e., they have the 
characteristics of money transactions. To preserve the 
integrity of the electronic monetary system, each exchange 
of electronic money includes, along with other 
information, data identifying the monetary unit of the 
credit or currency, (i.e., dollars, yen, etc.) the amount 
by unit of credit or currency, and the bank issuing the 
electronic credit or currency, and several digital 
signatures. 

Summary of The Invention 
In accordance with these and other objects of 
the invention, a brief summary of the present invention is 
presented. Some simplifications and omissions may be made 
in the following summary, which is intended to highlight 
and introduce some aspects of the present invention, but 
not to limit its scope. Detailed descriptions of a 
preferred exemplary embodiment adequate to allow those of 
ordinary skill in the art to make and use the inventive 
concepts will follow in later sections. 

According to a broad aspect of the invention, an 
electronic monetary system provides for transactions 
utilizing electronic money including electronic currency 
backed by demand deposits in a bank in lieu of cash 
transactions, and electronic credit authorizations. The 
invention comprises a money module for generating the 
electronic money; a money module for issuing, 
distributing, and accepting the electronic money; and a 
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money module for accepting, storing, and transferring the 
electronic money between other accepting money modules and 
between the accepting money module and the issuing money 
module. 

According to a further aspect of the invention, 
an electronic monetary system is provided for implementing 

' and maintaining electronic money which includes electronic 
currency that is interchangeable with conventional money 
through claims on deposits in a bank, and electronic 
credit authorizations. 

The system includes a plurality of issuing 

' banks; a generator for creating electronic money; teller 
modules coupled to the generator module, for performing 
teller transactions and for interfacing with other teller 
modules, such transactions including the accepting and the 
distributing of the electronic money; a security system 

' for providing the overall integrity of the electronic 
monetary system; a clearing and settling process for 
balancing the electronic money accounts of the separate 
issuing banks and for clearing the electronic money issued 
by the issuing banks; and a plurality of transaction 

1 modules owned by authorized users, for transferring the 
electronic money between the transaction modules and 
between the transaction modules and the teller modules. 

Xn accordance with another aspect of the 
invention, the functions of the generator modules, the 

' transaction modules, and the teller modules will be 
performed by a combination of tamper-proof computer 
hardware and application software that may be networked 
together. 

The electronic money exchanged by these modules, 
1 which may be an electronic representation of currency 
backed by demand deposit accounts at the issuing bank or 
credit authorizations, may be transmitted with digital 
signatures to provide security from unauthorized 
modification or counterfeiting. In a preferred 
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embodiment, security from counterfeiting and tampering is 
also provided by requiring the modules and the individual 
units of electronic money to be renewed periodically. 
Offending modules or counterfeit electronic money can be 
removed from circulation as soon as they are discovered. 
Briefly, a process in accordance with the 
5 invention comprises the steps of 

(1) providing a generating module to generate 
electronic representations of economic value backed by 
demand deposits or by a credit line; 

(2) providing a teller module to accept the 
generated electronic representations of economic value and 
to issue the electronic representations of economic value; 

(3) providing the authorized users with a 
transacting module for accepting, storing and transferring 
the electronic representations of economic exchange to 

^ other authorized users having the transacting module and 
to the teller processing module; 

(4) accepting and transferring the electronic 
representations of economic value to other authorized 
users having a transacting module and to the teller 

20 module; and 

(5) providing a security system to allow the 
transfer of electronic representations of economic value 
in a secure manner between the generating module, the 
teller module and the transacting module. 

25 

Brief Description of the Drawings 
Other objects and advantages of the present 
invention will become more apparent by the following 
description with reference to accompanying drawings, in 
30 whichi 

f igure 1 is a diagram illustrating general 
aspects of the invention; 

Figure 2 is a schematic diagram of the operative 
arrangement of the components, according to the invention. 
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Figure 3 is a perspective diagram of several 
embodiments of external systems that may house a money 
module, according to the invention. 

Figure 4 is a block form diagram of a 
transaction money module, according to the invention. 

Figure 5 is a block form diagram of a Teller 
5 money module, according to the invention. 

Figure 6 is a block form diagram of a Money 
Generator module, according to the invention. 

Figure 7 is a block diagram of the network 
arrangement, according to the invention. 
10 Figure 8 is a block diagram of a Network Sever, 

according to the invention. 

Figure 9 is a flow diagram of the security 
system, according to the invention. 

Figure lO is a block form diagram of a security 
server, according to the invention. 

Figures 11-24 are flow diagrams of accounting 
examples, according to the invention. 

Figure 25 a flow diagram of the Transaction 
Reconciliation System, according to the invention. 

Figure 26 is a flow diagram of the Clearing 
System, according to the invention. 

Figure 27 is a flow diagram of the Money Issued 
Reconciliation System, according to the invention. 

Figures 28-50A are flow charts of transaction 
examples, according to the invention. 
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Disclosure of the Preferred Embodiment of the Invention 
The present invention contemplates an improved 
monetary system using electronic media to securely and 
reliably exchange economic value. The system can be 
implemented by integrating novel data processing systems 
with other procedures which can be implemented with the 
current worldwide banking systems. 

Throughout this description, "electronic money" 
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o may also be referred to by the abbreviation "E-M." 
Additionally, the tern "bank" is used hereinafter to 
indicate any banking, financial institution or the like 
which is a participant of the present invention. 

Referring now to the drawings, wherein like 
5 numerals refer to like components, there is disclosed in. 
Figure 1, in block form, broad aspects of the preferred 
embodiment. In Fig. 1, the general relationship among the 
features of the system is shown. The system includes 
Issuing Banks 1 each having a Teller money module 5 and a 
10 Money Generator module 6; Correspondent Banks 2 each 
having a Teller money module 5; an electronic money 
Clearing Bank 3; a Certification Agency 28 and a plurality 
of Transaction money modules 4 owned by subscribers of the 
system. 

15 Electronic notes XX, the media for transferring 

electronic money, are generated by the Money Generator 
module 6 for an Issuing Bank 1. These notes 11 are then 
transferred by a Teller money module 5 to a subscriber 
utilizing a Transaction money module 4. Electronic notes 

2o 11 nay be representations of currency or credit 

authorizations. For security reasons, all electronic 
notes 11 will expire after a preset time period. Once 
expired, the notes 11 must be redeemed at a participating 
bank for updated ones before they can be transferred. 

25 An Issuing Bank 1 generates and distributes the 

electronic notes 11, and is liable for their redemption. 
An Issuing Bank 1 performs deposits, withdrawals, payments 
to loans and inquiries for other money modules. 

A Correspondent Bank 2 is a participating bank 

30 which distributes electronic money through accounts it 
maintains at Issuing Banks 1, but does not generate any 
electronic money, and is not liable for its redemption. 
Because it cannot generate any electronic money, the 
Correspondent Bank 2 in the preferred embodiment must make 

35 real-time requests of electronic money from an account it 
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, maintains at an Issuing Bank 1 whenever a subscriber 
wishes to withdraw electronic money at a Correspondent 
Bank 2. 

Conversely, a Correspondent Bank 2 deposits all 
electronic money deposited by subscribers, to the accounts 
the Correspondent Bank 2 holds at Issuing Banks 1. These 
accounts will be described hereinafter. A Correspondent 
Bank 2, like an Issuing Bank 1, will perform deposits 
withdrawals, payments to loans and bank inquiries. 

Notably, an Issuing Bank 1 may also be a 
Correspondent Bank 2 for the monetary units that it does 
not generate. For example, an issuing Bank 1 for 
electronic dollar notes 11 may be a Correspondent Bank 2 
for electronic notes 11 of yen, marks, issued by other 
banks etc. 

It is also important to note that system of the 
invention can function without correspondent Banks 2. For 
example, a subscriber can eliminate the use of a 
Correspondent Bank 2 by communicating directly with 
his/her Issuing Bank 1 when making a deposit, withdrawal, 
etc. Correspondent Banks 2 are included in the preferred 
embodiment for the practical purpose of expanding 
distribution of the system while reducing the risks that 
are inherent in any banking system, such as the risks 
caused by the collapse of a bank issuing money. 

The Clearing Bank 3 is utilized when more than 
one bank is issuing electronic money. According to the 
invention, it is anticipated that more than one bank will 
be issuing electronic money. Thus, the Clearing Bank 3 is 
provided to clear the electronic money deposited and to 

( balance accounts it maintains for the Issuing Banks 1. 
The Clearing Bank 3 maintains demand accounts for each 
Issuing Bank 1 in the system. 

The Certification Agency 28, is the centerpiece 
of the system security. It provides a process that 

. "certifies" the validity of a money module for a certain 
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B period of time by issuing a certificate to each money 
module. A money module must have a valid certificate in 
order to be able to transact with other money modules 4, 
5, 6. 

Before the certificate expires, it must be 
5 updated so that a subscriber can continue to use his/her 
transaction money module 4. This process makes users of 
the system establish periodic contact with the 
Certification Agency 28. 

Periodic contact allows for faster response when 
tampering with the money modules of the system is 
detected. To this end, the certification Agency 28 also 
provides a list of offending or compromised money modules 
to other money modules so that transactions with the bad 
units may be blocked. 

The components shown in Figure l are best 
15 understood by referring to the system's operative 

arrangement illustrated in Figure 2. As illustrated in 
Figure 2, the preferred embodiment provides for 
supplements to the current banking systems that include 
the following additional components: a plurality of the 
Transaction money modules 4, the Teller money modules 5, 
and the Money Generator modules 6, for creating, 
transferring and storing the electronic notes 11 (money) ; 
a Clearing System 13 to balance the accounts of banks 
issuing currency and credit; a security system 21 to 
maintain the integrity of the electronic notes 11; the 
current banking systems 20; a network 25 (exemplified by 
the lines interconnecting modules and systems) to mediate 
transactions between money modules 4,5,6, the 
participating banks 1,2,3 of system 20 and the security 

30 

system 21; a Transaction Reconciliation system 22 to 
detect money module malfunctions and insider tampering of 
the system; a Money Issued Reconciliation System 23 to 
detect counterfeiting and reuse of electronic money; and a 
Money Position System 24 to keep track of the electronic 
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u money in circulation. 

Playing mayor role in the preferred embodiment 
are three classes of "money modules" for creating, 
storing, and transferring the electronic objects that 
represent economic value. These include the Transaction 
^ money modules 4, the Teller money modules 5, and the Money 
Generator modules 6. It is contemplated that these money 
modules 4,5,6 will be a combination of tamper-proof 
hardware and application software that are meant to be 
components of a larger processing environment. 
iQ Referring to the top right-hand side of Figure 

2, a Transaction money module 4 containing electronic 
notes 11 stored therein (not shown) may be used to 
exchange foreign currency or make a payment with another 
Transaction money module 4, using a secure, encrypted 
protocol either by a telephonic link, or a proximate 
communication link. Because it is contemplated that an 
electronic note 11 will be fungible, i.e., it can be 
broken into any desired amount, the amount transacted 
between the Transaction money modules 4 nay be of any 
amount up to the amount stored in the payor's Transaction 

20 

money module 4. 

A payee's Transaction money module 4 that has 
received the electronic note 11 as a payment may, in turn, 
be Used to transfer all or any amount of the electronic 
money contained therein to another subscriber's 
Transaction money module 4. Alternatively, the payee may 
deposit the electronic money into his/her bank account. 

The value of the electronic money stored in the 
Transaction money module 4 may also be redeemed at any 
participating bank (e.g., Correspondent Bank 2 or Issuing 
30 Bank 1) for paper money by transferring any amount of the 
electronic money to a bank's Teller money nodule 5, 
whereby a teller or an Automated Teller Machine (ATM) will 
return an equal amount of paper money. Naturally, it is 
anticipated that paper money may also be exchanged for 
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° equal valued electronic money. 

As will be appreciated, the Transaction money 
module 4 may be configured to make deposits, withdrawals, 
loan payments, inquiries and exchanges of currencies of 
electronic notes 11 directly through a Teller money module 
5 5 at an issuing 1 or Correspondent Bank 2 or remotely 
through a telephonic connection to an Issuing 1 or 
Correspondent Bank 2 Teller money module 5 (thereby 
providing, among other things, the transactions not 
available in current home banking systems) . Upon a 
10 request to transact with a bank, the Teller money module 5 
mediates the transactions for the subscriber's bank 
account as well as the banking system's electronic money 
accounts . 

It should be noted that a subscriber will not be 

15 required to maintain a bank account in order to own and 
use a Transaction money module 4. For instance, a 
subscriber may obtain a stand-alone computing device that 
contains a Transaction money module 4 and use the device 
only in off-line peer-to-peer transactions with other 

20 devices containing a Transaction money module 4 , such as a 
merchant's point-of-sale terminal. Of course, the 
merchant may then transfer the electronic money to another 
commercial organization to meet its obligations, or it may 
deposit the electronic money at its own bank. 

25 in the preferred embodiment, electronic money 

deposited at any Issuing Bank 1 other than the original 
Issuing Bank 1 itself will subsequently be settled for 
value with the original Issuing Bank 1 through the central 
clearing and settling process performed by the Clearing 

30 System 13. It is anticipated that the clearing and 

settling processes will be managed by the Clearing Bank 3 
(Figure l~) . Bach Issuing Bank 1 Teller money module 5 
sends all the electronic notes 11 deposited at its bank 
but issued from other Issuing Banks 1 to the Clearing Bank 

35 3 in order to settle for the value posted to their 
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° customers' accounts. 

When a withdrawal, an exchange for foreign 
currencies, an exchange of paper cash for electronic 
money, or an updating of the electronic money occurs, the 
Honey Generator module 6 Figure 2, creates and digitally 
5 signs electronic objects having economic value - either • 
currency or credit notes XI (Figure 1) - that are to be 
sent. to the Transaction money modules 4 through the 
participating bank's Teller money modules 5 in the form of 
a packet of electronic notes 11. As mentioned above, the 

10 electronic currency notes 11 are the equivalent of bank 
notes that are backed by deposits, and can be traded 
between Transaction money modules 4. 

During the withdrawal transaction, the Teller 
money module 5 and the Transaction money module 4 may 

15 establish a communications link using an encrypted 

protocol to securely transfer the notes 11 from the Teller 
money module 5 to the Transaction money module 4. 

Records of the notes 11 generated and conveyed 
by the Honey Generator module 6 are sent to the local 

20 bank's Transaction Reconciliation System 22 and an Issuing 
Bank's i Honey Issued Reconciliation System 23 for 
maintaining statistical and housekeeping functions. 
Records of the electronic notes 11 cleared and settled at 
the Clearing Bank 3 are also provided to the Money Issued 

25 Reconciliation System 23 . From these compilations, a 
financial position of the system can be produced by the 
Money Position System 24. 

Discrepancies and malfunctions are reported to 
the Security System 21 which downloads the lists of 

30 problem money modules to all money modules in the system 
when they are connected to the Network 25. By carrying 
this list, a Transaction money module 4 will be inhibited 
from transacting with other suspect Transaction money 
modules 4. 

35 Having thus provided in overview of the 
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° preferred embodiment, there will now follow a more 
detailed description of the individual elements and the 
transactions between them. 

Money modules 

5 Figure 3 provides several embodiments of 

external systems or devices for housing money modules. 

In the preferred embodiment, the external system 
or device will typically contain data display means, data 
input means, data processing means, memory storage means, 

10 direct connection or contactless bidirectional 

communications means, and the money module packaged in a 
tamper-proof housing, all interfaced by suitable means for 
information transfer, such as are well known in the art. 

As will be understood, a money module may be 

15 embodied as a modular component of any larger processing 
environment while still performing the same functions. 
For example. Transaction money modules 4 may work as co- 
processors embedded in personal portable computing devices 
like the Hewlett-Packard 95LX, or as co-processors in 

20 mainframe computers, workstations, point-of-sale terminals 
or telephone devices (fixed or portable) connected to a 
network. 

A Teller money module 5 may be embodied as a co- 
processor in the bank's financial computer systems. - The 

25 Honey Generator module 6 could be a separate processing 
unit networked to the bank, a co-processor in a general 
purpose computer, or it may be combined with an Issuing 
Bank's 1 Teller money module 5 in a larger processor. 

Because it is anticipated that a money module 

30 will be implemented in a separate processing device, it is 
assumed that corresponding interface circuitry would be 
provided in the host processing device to provide 
communication between the processing device and the money 
module. 

35 Notably, all classes of money modules 



WO 93/10503 



PCT/US92/09732 



- 18 - 

o contemplated by the invention may be implemented, 
programmatically or by direct electrical connection 
through customized integrated circuits, or a combination 
of both, using any of the methods known in the industry 
for providing the functions described below without 

5 departing from the teachings of the invention. Those 
skilled in the art will appreciate that from the 
disclosure of the invention provided herein, commercial 
semiconductor integrated circuit technology would suggest 
numerous alternatives for actual implementation of the 

0 inventive functions of the money module that would still 
be within the scope of the invention. 



Transaction Money Module 

In one embodiment, the Transaction money module 
4 may be imbedded in any computer of any size or use, like 
those serving as general purpose computers or work- 
stations, to provide functions not limited to E-M 
transaction use. This latter application will allow for 
such uses as real-time, off-line payments between personal 
computing devices, or on-line payments for network 
services such as information retrieval, telephone calls, 
or for purchasing airline tickets, theater tickets, etc. 

In another embodiment, the Transaction money 
module 4 may be imbedded in an individual hand-held 
integrated circuit unit, such as a personalized hand-held 
computer that may be readily carried by an individual as 
though it were a wallet. As an illustration, the device 
of the preferred embodiment may include a keyboard, a pen 
or stylus, a touch screen or voice recognition circuitry 
as a data input means, an alphanumeric LCD dot matrix 
display as a display means, an infrared optical 
transceiver as a contactless bidirectional communications 
means, and an KJ-ll telephone jack coupled to modem 
circuitry as a telephonic communications means. 
Additionally, the device may also include various 
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electronic processing and storage means for providing 
calculator capabilities, for storage and processing data 
of the owner, etc. 

It is important to note that the particular 
design of the external device is not critical to the 
invention, and other technologies suitable for 
accomplishing the foregoing functions may also be used. 
For example, an LED instead of an LCD display panel may be 
used; radio, infra red, inductive or capacitive 
communications methods may be used instead of direct 
connection, optical communications methods may be used; 
10 etc. 

In general, it is anticipated that any 
Transaction money module 4 owned by a subscriber will be 
embodied in a self-contained, tamper-resistant unit that 
contains components which are difficult to access, and 
15 thus prevent any person from improperly examining, 
counterfeiting or modifying any of its contents or 
arrangements. For example, integrated semiconductor 
circuits, whose contents are difficult to examine, encased 
in a tamper-resistant package such as that formed by an 
epoxy or plastic lamination may provide a high degree of 
physical security while providing the necessary storage, 
computation, timing, and other data processing functions. 

However, the invention is not limited to any 
particular tamper-resistance means, inasmuch as there are 
a number of methods known in the industry for providing 
such security. Such tamper-resistance will also prevent 
the owner, who can control only some of the internal 
operations of the Transaction money modules 4, from 
certain accesses to thereby provide security from abuse to 
^° other relevant institutions and individuals. 

Each Transaction money module 4 will have a way 
of ensuring its own association with a particular 
subscriber, so that its use by other individuals may be 
limited. In addition to the use of Personalized 

35 
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Identification Number (PIN) methods that are well known in 
the art, the Transaction money module 4 may also include 
means such as a fingerprint reader, voiceprint analyzer, 
written signature analyzer, or other so-called biometrics 
means, to determine the physical identity of an authorized 
subscriber. 

Additionally, the Transaction money module 4 may 
utilize personalized interactive proofs using questions 
that only a true owner would be able to correctly answer, 
such as the owner's mother's maiden name, his/her favorite 
color, etc. Any such techniques may provide additional 
security for organizations, and may also be to the 
advantage of the authorized user since such security can 
protect the subscriber's data from inspection and use by 
someone else coming into possession of the Transaction 
money module 4. 

Because the Transaction money module 4 can take 
on a variety of physical representations, it will be 
described by the functions performed in addition to the 
pertinent physical characteristics of a preferred 
| embodiment. 

Referring now to Fig. 4, a Transaction money 
module 4 is shown diagrammatically in block form. 
Specifically r a Transaction money module 4 has (1) an 
external interface 30 that interfaces the Transaction 
. money module 4 to the module's data processing means, the 
input/output means (human interface) and the 
communications circuitry of the external device; (2) a 
session manager 31 to control and commit (i.e., finalize) 
or abort a transaction session; (3) a transactor 32 to 
, manage application functions; and (4) a money holder 38 to 
contain and manage the electronic representations of 
money. 

According to the invention, the following 
application functions may be implemented in the preferred 
embodiment of the present invention: 
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„ The To Subscriber application 33 performs the 

function of comparing the owner identification 
characteristics, such as a user's personal identification 
number (PIN) and biometrics characteristic (e.g., 
fingerprint, voiceprint, etc.), that are stored in the 
j memory of the Transaction money module 4, to those of the. 
individual who is attempting to gain access to the 
Transaction money module 4. After the proper ownership is 
verified, the Transaction money module 4 may be activated, 
and the user is allowed certain accesses to the 
Transaction money module's 4 stored contents. Messages to 
the subscriber, and subscriber inquiries as to the 
information contained within the Transaction money module 
4 are also handled by this application function. 

The To Teller application 34 interfaces the 
Transaction money module 4 to the Teller money modules 5 
for initiating and performing deposit, withdrawal, loan 
payment transactions, and bank inquiries with such Teller 
money modules 5. 

The Pav/Exchanae application 35 supervises the 
sending and receiving of electronic notes XI between 
Transaction money modules 4, managing the process in which 
the electronic notes 11 are properly "packaged" as to 
amount, digital signatures, etc. This application 
provides that the electronic notes 11 are transferred in a 

25 recognized, valid format. Notably, this is the 

application that allows a money module to perform payments 
and foreign exchanges. Without this application in the 
preferred embodiment, a Transaction money module 4 cannot 
make a payment to another Transaction money module 4. 

3Q The Tran Loo Mar, application 36 provides the 

management and overseeing of a log that records completed 
transactions undertaken by the money module. For each 
completed transfer of electronic money, an illustrative 
Tran Log records: 

3 g (1) the type of transfer (i.e., payment, 
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, deposit:, foreign exchange, etc. ) , 

(2) the date of transfer, 

(3) the amount of transfer, 

(4) the Issuing Bank 1 identifier 

(5) the note identifier, 
. (6) the monetary unit, 

(7) the identifier of the other money module 
involved in the transaction, and 

for deposits, withdrawals and loan payments: 

(8) the bank account number, 

, (9) the bank identifier, and 

(10) the amount of the transaction. 

In the preferred embodiment, every money module 
will have an identifier. A money module identifier may be 
thought of as the "serial number" of the money module and 
is never changed. 

It is anticipated that a subscriber may have 
access to several of the fields of data stored in the Tran 
Log application, such as histories of the amount, date, 
and type of transfer. Information as to the expiration • 
date of a certificate may also be accessed by the 
subscriber so that he/she will be informed as to the need 
to update or revalidate the money module's certificate. 

The Maintain Security application 37 manages a 
list of money module identifiers that are known to have 
been generally compromised. In particular, this is a list 
that is distributed to each money module when it 
communicates with the Network 25, and is a list of money 
modules that have passed an invalid or counterfeit 
electronic note 11 or have performed acts deemed 
detrimental to the system. 

When establishing a session between money 
modules, each money module checks its list of bad money 
modules to see if the other is an offending money module. 
If the other money module's identifier appears on the 
list, the communication is broken off. 
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, This application also provides the process for 

obtaining the certificate unique to the money module, for 
synchronizing the internal clock, and for managing the 
creation of new cryptography keys. 

The Note Directory 39 application performs the 
function of keeping track of the location, identification 
and value of the electronic notes XI stored within the 
money module. A note 11, whether it is an electronic 
currency note or ah electronic credit note, is the basic 
unit of electronic money. It is the electronic object 
representing the economic value, the electronic bits that 
contain the amount, expiration date, note identifier etc. 
(described in detail below) that gets digitally signed 
(described below) and encrypted when being transferred. 
Both electronic currency notes It and electronic credit 
notes 11 may be located by the Note Directory 39. 

The Note Directory application 39 updates 
summary totals of the current amount of electronic notes 
11 (both currency and credit) , by monetary unit after 
every transfer. A date-of -expiration, a note 
identification number and an Issuing Bank identifier is 
also recorded with the location of each note 11. 

In summary, the Note Directory 39 keeps track of 
the note identification number, the Issuing Bank 1 
identifier, the date-of -expiration of the note 11, the 
location of the note 11 as stored in the Transaction money 
module 4, and the current amount of the total value of the 
notes 11 stored for each monetary unit. These records are 
maintained for both electronic currency and electronic 
credit. For a credit note 11, the account number of the 
credit line is also maintained. 

The Notes application 40 manages the storage of 
the representations of the electronic notes 11 themselves, 
both currency and credit notes ll. This application also 
generates the transfers when notes 11 are to be conveyed. 

The Packet Manager application 41 manages the 
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construction and formatting of a packet of electronic 
notes 11 that are to be transferred to another money 
module. For example, the Packet Manager 41 will utilize 
an algorithm so that the least number of electronic notes 
11 are used to fulfill the requested amount of transfer, 
with the earliest dated electronic notes 11 being used 
first. Alternatively, when a packet of notes 11 is 
transferred to the receiving money module, the Packet 
Manager 41 application "disassembles » the packet, 
verifying the date and separating the data fields that 
represent the different electronic notes 11. 

The formatted packet gets several data fields 
appended to it when electronic notes 11 are "assembled." 
An identifier data field provides the indicia that 
identifies it as a packet. Additionally, data fields for 
the total value of the notes 11, the number of notes 11, 
and the individual locations of the notes li are provided. 

The Verifier application 42 verifies that a 
received packet contains valid electronic notes 11 before 
a receiving money module accepts them. The Verifier 42 
also checks that the total amount received is equal to the 
sum of the electronic notes 11 that are to be transferred. 
If the total amount and the individual electronic notes 11 
are valid, an acknowledgment is returned to allow for 
completion of the transfer. Otherwise, an "invalid" 
message is sent, and the transfer may be aborted. 

Services applications that are provided fall 
under two categories: Clock/Timer 43 and Cryptography . 
The Clock/Timer 43 provides output pulses for controlling 
a transaction timeout, such as the time between the 
sending of a message and the return of a corresponding 
message. 

As will be appreciated, when two money modules 
are communicating, they may be monitoring a time-out 
protocol. For example, after a first money module has 
sent a message to a second money module, the Session 
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Manager 31 of the first money module ("A") may set a timer 
for a reply if the Transactor 32 indicates that a reply is 
required. The Session Manager 31 may also number the 
message sent. This number would appear in the reply 
message from the Session Manager 31 of the second money 
module ( M B" ) . 

If the timer expires before the message has been 
received, then Session Manager A 31 will query Session 
Manager B 31 to determine if the transaction is still 
running in B. If B does not reply then Session Manager A 
31 will abort the transaction. If a reply is received 
that the transaction is proceeding, then the timer will be 
reset to a new time. If A queries B a predetermined 
number of times without receiving a reply to the original 
message, then A may abort the transaction. 

Separately, this application also maintains the 
current date and time, both for user display and for 
verifying that an electronic note 11 to be received is not 
an expired one, along with other general clock functions 
that are commonly used in the industry. 

The Cr yptography application contains a Public 
Key 44 operation, a Symmetric Key 45 operation, and a 
Random Number Generator 46. While the tamper-resistance 
of the Transaction money module 4 and its components makes 
it difficult for a person to modify the structure of the 
device or its contents, known cryptographic techniques are 
also employed to provide secure communications and payment 
transfers between money modules. 

Public kev cryptography 44, as is well known in 
the art, may be employed by this application to provide 
public key digital signatures, which are called "digital 
signatures** or simply "signatures" for brevity. The data 
in electronic notes 11, may be represented by a digital 
number. The electronic notes 11, are signed by digital 
signatures formed from this number. A digital signature 
can then be checked as corresponding to a particular 
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message by anyone knowing the corresponding public key, 
which in the preferred embodiment would be all other money 
modules. 

This application provides each money module with 
the ability to check the digital signature for 
authenticity. A money module receiving the digitally 
^ signed electronic note 11 can in turn sign and transfer it 
to others, who could also check, sign and distribute it. 

Because of the "one way" nature and 
computational complexity of public-key digital signatures, 
it is thought to be infeasible to decipher and duplicate 
10 them within a feasible period of time, making such a 
security system resistant to forgery. 

Lastly, this application also creates new public 
and private keys when needed. 

Symmetric Key cryptography 45 provides private 
15 key algorithms that are well known in the art, for 
individual session security and privacy between money 
modules. In the preferred embodiment, this application 
provides encryption/decryption means in order to secure 
information being exchanged between two money modules. 
20 Any well known symmetric key cryptography 

technique, such as the National Data Encryption Standard 
(DES) system or other cryptography techniques, may be 
provided in this application. For example, due to the 
increasing interest in providing cryptographically secured 
25 communications, manufacturers are providing various 

semiconductor integrated circuit devices which perform the 
encryption and decryption of data. Cylink corporation's 
CIDEC data encryption devices are examples of commercially 
available encryption/decryption circuitry that would be 
3° suitable in the present invention for this application. 
Due to the federally mandated use of the DES algorithm, 
devices such as these are widely utilized to implement 
that algorithm. 

Xt is important to note that the details of the 

35 
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particular cryptographic methodology utilized by the money 
modules are not critical and are not limited to a 
particular cryptographic technique. 

The Random fJumtwt- Generator 46 generates random 
like numbers for creating new public/private keys for the 
Public Key application 44 and new private keys for the 
symmetric Key 45 application. This application is 
utilized to vary in an unpredictable way the generation of 
temporary session keys. 

Circuitry for providing such random number 
generation capability are well known in the art., For 
instance, a circuit utilizing a "noisy" diode may provide 
random values, as is well known in the industry. Random 
numbers may also be provided by a pseudorandom number 
generator circuit which implements a mathematical 
algorithm, such as the power-residue algorithm, that 
generates apparently random values from a "seed" number. 
The use of clocks or counters provides another often used 
source of random data. As will be understood, the Random 
Number Generator 46 may use techniques that are well known 
to a person of ordinary skill in the art to generate the 
temporary numbers, and thus need not be further described. 

It should be further understood that the 
foregoing functions disclosed herein may be performed by 
known programming techniques and/ or dedicated hardware and 
in some cases may be combination of both or shared 
resources from each. As may be appreciated by a person 
skilled in the art, many changes in form and detail can be 
made in dependance on specific application requirements 
without departing from the essential features of the money 
modules. 

Teller money module 
The banking systems 20 of both the Issuing Banks 
l and the Correspondent Banks 2 interface to the system of 
the invention through a Teller money module 5. The Teller 
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money module 5 may be imbedded in any general purpose 
computer or workstation. The particular design of the 
Teller money module 5, like the Transaction money module 
4, may be implemented in readily known programming 
techniques or dedicated computer hardware, or a 
combination of both. As will be appreciated by a person 
skilled in the art, various designs of the Teller money 
module 5 may be employed to implement the functions 
described herein. 

The details of one embodiment of the Teller 
money module 5 is shown in block form in Figure 5. The 
Teller money module 5 contains many of the same components 
and application functions of the Transaction money module 
4 described above. Therefore, the identical components 
will only be repeated briefly here, while the 
distinguishing components will be fully described. It 
should be noted that the Teller money module 5, like other 
money modules of the system, is also contained within a 
tamper-proof enclosure of the type common in the industry, 
so as to ensure the necessary security involved. 

The Teller money module 5 contains an External 
Interface 30, a Session Manager 31, a Transactor 32 and a 
Money Holder 38 that perform similar functions to the 
corresponding components in. the Transaction money module 4 
described above. 

Briefly, the External interface 30 interfaces 
the Teller money module 5 to other processing and 
communications means within the Teller money module 5 host 
processor; the Session Manager 31 acts to control and 
commit (i.e., finalize) or abort a transaction session 
between the Teller money module 5 and another money 
module; the Money Holder 38 manages the storing and 
retrieval of electronic money; and the Transactor 32 
manages the application functions of a To Teller 34, the 
Tran Log Mgr. 36, the Maintain Security 37, the To Bank 
47, a To Money Generator 48, and the To Transaction 49. 
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The following list describes in brief, the 
applications contained in the Teller money module 5 that 
are functionally identical to the applications found in 
the Transaction money module 4: 

To Teller 34: Interfaces deposit and 
withdrawal functions to another Teller 
money module 5 . 

Tran Log Mgr. 36: Transaction log manager 
for recording transaction details. 

- Maintain Security 37 : Manages the list of 
compromised money modules, applies for 
certificates, synchronizes the clocks, and 
manages the creation of new digital keys. 

Note Directory 39: Keeps track of the 
location, value and identification of notes 
11 by monetary unit. Summary totals are 
also maintained. 

Notes 40: Manages storage for the 
electronic notes 11 of exchange, and 
creates the transfers for the notes 11. 

Packet Manager 41: Manages the. assembly 
and dissembly of a packet to be transferred 
to a different money module. 

Verifier 42: Verifies that a received 
packet contains valid electronic notes 11. 

Clock/Timer 43: Controls transaction 
timeout, expiration of the validity of the 
electronic notes 11, expiration of the 
certificate, and general clock functions. 

- Cryptography 

(i) Public key 44: used for signatures to 

sign and validate notes 11 and to set 
up a secure transaction session. 

(ii) Symmetric key 45: Controls the 

security of a transaction session. 

(iii) Random number generator 46: Generates 

random like numbers for new 
cryptographic keys. 

Some of the distinguishing applications are the 
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To Bank 47 and To Transaction 49 applications. The 2o 
Bank application 47 provides the interfacing means whereby 
the Teller money module 5 can perform exchanges of data 
for inquiries and account postings with the on-line 
systems of a bank. This application is also utilized for 
crosschecking the customer's account number with the 
accounts and type of transaction being requested. 

The To Transaction application 49 performs 
deposits, withdrawals and payments to loans. This 
application operates whenever a Teller money module 5 is 
transacting with a subscriber's Transaction money module 
4. 

As mentioned above, a Teller money module 5 may 
be associated with an Issuing Bank 1 or a Correspondent 
Bank 2. When Teller money module S is associated with a 
Correspondent Bank 2, it is utilized for intermediating 
deposits, withdrawals, and payments to loan accounts 
between a Transaction money module 4, the Correspondent 
Bank's 2 on-line systems, and an Teller money module 5 at 
an Issuing Bank 1. 

When operating in an Issuing Bank l mode, the 

1 Teller money module 5 is used for intermediating deposits, 
withdrawals, and payments to loan accounts between other 
money modules and the Issuing Bank's 1 on-line systems. 
Additionally, when the Teller money module 5 is performing 
in an Issuing Bank 1 mode, a To Money Generator 

' application 48 may be employed when requesting new notes 
11. 

Basically, the To Honey Generator application 48 
performs banking functions dealing with requests for 
electronic notes 11. It interfaces an Issuing Bank's 1 
* Teller money module 5 to a Honey Generator Hodule 6. 

All of the other elements performed in an 
Issuing Bank's 1 Teller money module 5 are essentially 
identical to the similarly named components and 
application functions described above. 
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, Money Generator Module 

Figure 6 is a block diagram illustrating the 
application functions of a Money Generator module 6. 
Money Generator modules 6 provide the mechanism that 
Issuing Banks 1 utilize to issue electronic money. A 
. Money Generator module 6 is also encased in a tamper- 
resistant package for the same security reasons stated 
above for other money modules. 

A Money Generator module 6 generates the 
electronic money (in the form of electronic notes 11, to 
be described in further detail below) , and distributes 
them to other money modules through the Teller money 
module s of an Issuing Bank 1. The Money Generator module 
6 includes a unigue application not present in other money 
modules for responding to requests for electronic money. 
This is the Money Creator application 50. 

The Money Creator application 50 creates and 
formats the electronic objects representing value - either 
currency backed by demand deposits, or credit 
authorizations - and digitally signs these "electronic 
notes 11" using public key cryptography in conjunction 
with its secret key, so that it may be sent to an Issuing 
Bank's Teller money module 5. 

Notably, in a Money Generator module 6 the To 
Bank application 47 notifies the bank systems of any 
irregularities, off-loads transaction records in the Tran 
Log to the Transaction Reconciliation System 22 and 
transfers electronic notes 11 to the Money Issued 
Reconciliation System 23. All of the other applications 
of the Money Generator module 6 are identical to the 
similarly named applications of the money modules 
described above.. 



35 



The Network 

According to one embodiment of the invention, 
the individual components of the present invention may 
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communicate over a Network 25, as shown in Figure 7. The 
Network 25 will link together the Issuing Banks 1, 
Correspondent Banks 2, the Clearing Bank 3 and the 
Certification Agency 8. 

Transaction money modules 4 may be coupled to 
the Network 25 over the telephone exchange or via special 
terminal facilities at bank locations (e.g., additional 
contactless or cable connections at an ATM booth) . A 
communication layer will carry transaction requests (e.g., 
deposits, withdrawals), packets of notes 11 and new 
certificates securely across the Network 25. In the 
preferred embodiment, the Network 25 will also provide 
directories of financial services, and update the money 
module clocks and the bad money module list of all money 
modules . 

As will be understood, the Network 25 may use 
well known data link or communications systems and 
techniques that utilize, for example, telephone lines, 
fiber-optic land lines, and satellites, and that include 
connective, timing and control software and circuitry for 
allowing access and transmitting digital information. The 
Network 25 may use commercially available protocols and 
operating techniques such as those set forth by the 
International Standards Organization ("ISO") for Open 
Systems Interconnect network standards. It is important 
to note that the particular design of the Network 25 is 
not critical and suitable technologies for accomplishing 
the foregoing data communications functions may be used. 

Each entity (Banks 1 and 2, Certifying Agency 
28, or Clearing Bank 3) is also assumed to have an 
individual local network 16, 17, IS and a gateway to the 
larger system Network 25. The larger Network 25 will 
provide directory services for the routing of messages to 
connect to the appropriate local network 16, 17, 18. The 
local network 16, 17, 18 has the responsibility of routing 
messages to the correct money module or Security Server 
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„ 27. A Security Server 27 is associated with each 
participating bank and the Certification Agency 28, and is 
used for implementing the security of the system. 

Figure 7 illustrates the preferred embodiment of 
the Network 25 generally, indicating that money modules of 
5 any participating bank may be intercoupled to the money 
modules of other banks and financial institutions, or 
another subscriber's Transaction money module 4 via a 
communications link directly connected into switching and 
processing centers and alternatively connected to a local 

1Q network 16, 17, 18 at each entity. 

A money module need only identify the local 
network 16, 17, 18 destination (typically a bank 
subnetwork) for the transmission of most messages. The 
local network 16, 17, 18 will route the message to an 

^5 appropriate money module for establishing a session. Once 
a session is established, the Network 25 directs all 
messages between the two money modules. The Network 25 
also controls messages between money modules and Security 
Servers 27. 

20 Transaction money modules 4 may communicate over 

the Network 25 for deposits, withdrawals, payments to loan 
accounts, updates or inquiries. The Teller 5 and Money 
Generator modules 6 will sign on the Network 25 
periodically to update security information. The sign-on 

2j will be initiated by the money module Session Manager 31, 
or by the bank Security Server 27 if recertif ication is 
required or if there are changes to the bad money module 
list. 

A bank services directory may be available to 
3Q the money modules primarily for updating the electronic 
notes 11 and performing foreign exchange. A list of 
participating banks for either service will be available 
from the Network 25. 

In the preferred embodiment, the Network 25 will 
provide time services to the individual components of the 
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present invention. Transaction 4, Teller 5 and Money 
Generator nodules 6 and Security Server 27 clocks nay be 
updated fron a Network Server 26 in the Network 25 every 
tine that the respective noney nodule accesses the Network 
25. 

Network Servers 26 nay provide the noney nodule 
services described below, and gateway services to the 
local networks 16, 17, 18. The application functions of 
the preferred embodiment of the Network Server 26 are 
shown in the block diagram of Figure 8. The following 
application functions are contemplated for the Network 
Sever 26 s 

(1} External Interface 56 - a communications 
layer which interfaces to the Network 25; 
and 

(2) Communication Session Manager 57 - nanages 
a communication session between noney 
modules, and between a money module and the 
Security Server 27. . 

Application Services are provided by: 

(3) Manage Network Sign-on 58 - controls the 
money module Network sign-on process; 

(4) Synchronized Time/Date 59 - keeps money 
nodule Clock/Timer 43 services synchronized 
to a system tine; 

(5) Route Message 60 - directory services for 
routing messages, controlling nessage 
routing during sign-on and during a noney 
nodule session; and 

(6) Direct to Bank Services 61 - provides 
information on services provided by. 
participating banks. 

As will be appreciated by one skilled in the 
art, switching and processing centers that are known in 
the industry nay be used to enable the networking 
cooperation between a financial institution and any other 
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o that is coupled to the sane centers. 

Electronic notes 
We turn now to a further description of the 
elements of the electronic notes 11 themselves. 
5 An electronic currency note 11 representing 

value is essentially an electronic object created from a 
transaction request (deposit or withdrawal) which is 
backed by demand deposits at an Issuing Bank 1. At 
various times and in various points of the system, the 
j 0 notes may appear in electrical or magnetic forms or as 
electromagnetic radiation. These notes 11 may be 
transferred over several transactions just like paper 
money, with the additional property of fungibility that 
allows the electronic notes 11 to be commuted and 
12 transferred in amounts less than or equal to the value of 
the note 11. 

Notes 11 may be split by appending a transfer 
record to the note 11 and signing the note 11 using the 
private cryptographic key of the money module transferring 
2o note 11. Electronic credit notes 11, however, can 

only be transferred once in the preferred embodiment, 
because it is anticipated that its receiver must deposit 
the credit note 11 so that the loan may be realized. 

credit notes 11, unlike currency notes 11 are 
25 drawn on a subscriber's loan account. Each credit note ll 
carries the account number it is drawn on. The account 
may be a revolving credit or credit line on which the note 
11 is drawn, operating much in the same way that a check 
or a credit card account works in today's banking 
2Q industry. Credit notes ll can represent a part of or all 
of the credit line of the account. 

In the preferred embodiment, the credit notes ll 
can only be transferred to another Transaction money 
module 4 by the owner of the account, and the receiver of 
35 a credit note 11 can only deposit it into his or her 
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account as currency. From there, the credit note 11 is 
cleared with the currency at the Clearing Bank 3. The 
subscriber's bank recognizes the loan upon receipt of the 
cleared credit note 11. 

When credit notes 11 are withdrawn, they do not 
trigger any accounting transactions in the preferred 
embodiment. Current credit line processing may to be 
modified to keep track of the amount of the credit line in 
the subscriber's Transaction money module 4. Whenever the 
subscriber communicates with the Issuing Bank 1 
maintaining the credit line, the amount of the credit line 
in the Transaction money module 4 is removed and replaced 
based on any adjustments to the credit line in the banking 
system 20. Total credit notes 11 plus outstanding loans 
must be less than or equal to the total amount of the 
credit line. 

Electronic notes 11 are comprised of three 
collections of data fields, namely a Body group, a 
Transfer group, and a Signatures and Certificate group. 
The Body group of data fields includes the following 
information: 

CI) the type of electronic note 11, i.e., 
whether it is a currency note 11 or a 
credit note 11; 

(2) the Issuing Bank's 1 identifier; 

(3) the monetary unit identifier; 

(4) a Note identifier; 

(5) its date-of -issue; 

(6) its date-of-expiration; 

(7) the subscriber's account number (used only 
for credit notes 11) ; 

(8) the amount or value of the note 11; and 

(9) the Honey Generator module 6 identifier. 
The Transfer group of data fields includes: 
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(1) a total of the number of times that the 
electronic note IX was transferred; 
(provided for currency notes 11 only) 

(2) a list of transfer records that indicate to 
whom the apportioned note n was 
transferred from, the date-of-transf er, the 
amount transferred and the identification 
number of the receiver. 

The Signature and Certificates group of data 
fields includes: 

(1) the digital signature of the Money 
Generator module 6; 

(2) the Honey Generator module 6 certificate; 

(3) a list of payers which contains each 
payor's signature and certificate; 

(4) the digital signature of the payor; and 

(5) the payor money module certificate. 

The notes 11, transfer records, the signature 
and the certificate of the chain of the transferred 
payments constitute the electronic note 11 sent; the 

20 remaining amount of the note 11 is recorded in the Note 
Directory 39 of the money module in which it is stored. 

It is important to note that the authenticity of 
an electronic note 11 is determined by the validity of the 
digital signature of the Money Generator module 6, and the 

25 validity of the signatures of past payors (if present) . 
Any inconsistencies in this information will case the 
transfer of any electronic notes 11 to be aborted. 

It is also important to note that as a security 
measure, notes 11 will be valid for a limited time, up to 

30 its expiration date. An expired note 11 cannot be 
transferred, it must be updated by transacting with a 
participating bank. To this end, whenever a Transaction 
money module 4 performs any transaction with a Teller 
money module 5, all of the electronic notes 11 stored in a 

35 Transaction money module 4 will be transferred to the 
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o Teller money module 5 so that notes IX may be replaced 
with updated ones before they expire. This security 
procedure also helps to keep offending notes 11 from being 
circulated broadly. 

As will be understood, every time that a note 11 

5 is transferred to another money module, a digitally signed 
transfer record indicating from whom it is transferred is 
appended. Thus, the recipient of an electronic note 11 
will also receive a record of all of the past holders of 
the note 11. 

1Q For example, a $50 electronic note 11 may be 

generated, and withdrawn by a Transaction money module 4. 
Assuming it is transferred to other money modules in $10, 
$10, and $30 denominations, the recipient money modules 
will receive the note 11 with the transfer record 

^ 5 identifying the first Transaction money module 4. When a 
recipient of the $10 note 11 transfers $5 of it to a third 
party, the third party receives the note 11 along with the 
record indicating the previous two holders. Assuming this 
$5 note 11 is then deposited, a record of it will be 

2Q matched with other segments of the original $50 note 11 
that find there way back into the banking system by the 
clearing and reconciliation processes of the present 
embodiment. 

Only the receiver of the transferred note 11 can 
2^ either deposit the note 11 or use it in payment. The 

Verifier 42 application of a money module is used to check 
the signature of each transfer, to determine if the note 
11 is valid and to verify the identifier in the last 
transferor as the current holder of the note 11. This 
^ 0 thwarts the new holder of a note 11 from trying to use a 
value greater than that which was transferred, it also 
inhibits copying notes 11 for use in another money module 
since the identifiers will not match. 

As can be appreciated, a subscriber may be able 
to access certain information about the electronic notes 
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, 11 stored within the Transaction money module 4. 

In particular, the subscriber may be able to 
select information on the total amount of the electronic 
notes 11 stored, the monetary unit of the notes 11, the 
type of electronic notes 11, i.e., currency or credit, and 
the denomination of each note 11. 

System Security 

The security of the system is maintained by the 
participating banks and the Certification Agency 28, which 
creates and distributes money module certificates. A 
certificate of a money module is actually a the money 
module* s identifier, its public key, a digital signature 
of a money module's identifier and public key 
certif icatory key (described below) , and the version of 
the certif icatory key. The certificate is unique in that 
it is associated with only one particular money module. 

The Certification Agency 28 provides a secure 
means for money modules to validate each other prior to 
transacting, first by controlling the money module 
certificate process and second, by distributing a list of 
bad money module identifiers. 

In the preferree embodiment, the money module 
certificate will be initially loaded into the money module 
by the Certification Agency 28. The Certification Agency 
28 generates the certificate for each money module using a 
certificatory key (a private key of the Certificate Agency 
28) . It may be changed periodically and distributed under 
version control processes that are commonly used in the 
industry. As will be appreciated, every money module will 
store several versions of the certificatory key in order 
to verify certificates created by an older key. Because 
it is anticipated that certificates will expire over time, 
it is expected that only a few versions need be kept. 

A certificate will only be valid for a limited 
period of time after its creation. Upon expiration of the 
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, certificate, the money nodule will not be allowed to 
transact with other money modules. Any money modules 
discovered to have been tampered with will be limited in 
the amount of damage that they can do to the system since 
their certificate will not be updated. 

To block offending modules from transacting it 
is also desirable to have legitimate money modules receive 
the latest list of offending money modules soon after the 
list is updated. Naturally, this reguires that 
Transaction money modules 4 access the Certification 
Agency 28 on a periodic basis to obtain the latest list. 
Placing a time limit on the Transaction money module's 4 
ability to transact (in addition to the time limit placed 
on electronic notes IX) will force subscribers to access 
the Certification Agency 28 through the Network 25 on a 
periodic basis to receive the latest bad money module list 
along with the a new certificate. Advantageously, the 
period of the certificate validity can be closely 
monitored and adjusted according to security needs. 

The Certification Agency 28 distributes its 
updated certif icatory key and money module certificates 
on-line through the Security Server 27 (see Figure 9) . An 
important component of the system's security is provided 
by Security Servers 27 at the participating banks and 
Security Servers 27 at the Certification Agency 28. 

Referring now to Figure 10, a block diagram of a 
preferred embodiment of the Security Server 27 is shown. 
It is contemplated that the Security Server 27 at the 
Certification Agency 28 or on a bank's local network 18 
will contain the following application functions: 

(1) External Interface 54 .- a communications 
layer for connecting to a bank's local 
network 18 or the Certification Agency's 
local network 17; 

(2) Session Manager 55 - controls the security 
aspects of a transaction session; 



WO93/10SQ3 



PCT/US92/09732 



- 41 - 

» (3) Create Certificate 50 - certifies a 

certificate for any of the money nodules; 

(4) Create Account Profile 51 - certifies and 
signs a bank account profile (described in 
detail hereinafter) that allows a 

. Transaction money module 4 to access the 

subscriber *s different bank accounts; 

(5) Distribute Certification Keys 52 - 
distributes the Certification Agency's 28 
list of valid public keys to the money 

| modules ; 

(6) Bad Money Module Control 53 - controls and 
distributes the list of bad money modules; 
and 

(7) Services - identical to the cryptographic 
functions 44, 45, 46 in the money modules 
described above 

Since certificates will expire over time, money 
modules will be required to apply for new certificates 
periodically. In order to receive a new certificate, the 
money module creates a new public key and private key* 
The new public key, the money module identifier and the 
old certificate are presented to the Certification Agency 
28 after being digitally signed using the old private key. 

The Certification Agency 28 checks the signature 
and if it is valid, signs the new public key and 
identifier and sends the certificate to the money module 
with a future expiration date. The Certification Agency's 
28 Security Server 27 also distributes a list of bad money 
modules via the network 25. Initially, each participating 
bank's Security Server 27 reports the identifiers of money 
modules which hold notes 11 invalidly or that are 
counterfeit. Those identifiers are passed through the 
Security Servers 27 and are compiled by the Certification 
Agency 28. 

All such identifiers are distributed to the 
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« Teller and Honey Generator modules 5, 6 respectively. A 
money module will not transact with another money module 
found on the list of bad money modules. Optionally, only 
those money modules which have demonstrated a flagrant 
breach of security will be distributed to Transaction 
5 money modules 4. 

If a Transaction money module 4 is lost or 
stolen, the subscriber would report it to his/her bank or 
to the Certification Agency 28 so that the money module 
identifier may be placed on the bad money module list to 
l0 inhibit any further transactions. 

While the security of the system is provided by 
being able to block a money module from transacting, 
system security is also maintained by providing the 
expiration date on the electronic notes 11 in addition to 
the money module certificates. 

As mentioned previously, a note 11 will be valid 
only for a limited time period after it is generated. Its 
date-of-expiration is a security parameter which may also 
be monitored and varied as needed. The period of validity 

2o of a note 11 can be varied by the value of the note 11. 
Preferably, a large note ll will expire in a shorter time 
period than a smaller one. For example, a $1,000,000 note 
may be set to expire five days after the date of its 
creation since it would provide a significant incentive to 

25 counterfeit, while a $50 note 11 may be set to expire 
after a month from the date of its creation. 

A Transaction money module 4 will not accept 
expired notes 11, but can deposit or exchange the notes 11 
it may contain for new notes 11. The expiration dates are 

30 checked by the Verifier 42 and Clock/Timer 43 applications 
in a money module before any electronic note 11 is 
transferred. Separately, it is also anticipated that if 
the money module loses power then it will not be able to 
pay or exchange notes ll after power has been regained 

35 until it has communicated again with the Network 25 and 



PCI7US92/09732 



- 43 - 

« had its security parameters updated. 

As stated above, a subscriber will typically 
obtain a Transaction money module 4 already loaded with a 
certificate. Securing the Transaction money module 4 
itself to a subscriber may be accomplished by assigning it 
5 a unique PIN, biometrics or other personal secret 
characteristics . 

Before any personalization of the money module 4 
may proceed, the Transaction money module 4 checks if 
there is a bank account already stored in the To Teller 34 
10 application or if the Hotes 40 application contains any 
electronic notes XI. In either of these cases, the 
Transaction money module 4 will inhibit the subscriber 
from securing the module with new secret information. 

If the Transaction money module 4 has no account 

15 numbers or no stored notes XX, then the subscriber can 

secure it by either entering a PIN, which is reverified by 
the Transaction money module 4, or by executing a process 
in which the Transaction money module 4 learns the 
subscriber's biometrics, once the personalization has 

20 been completed, subscriber access to the Transaction money 
module 4 requires the successful completion of a sign-on 
in which the secret information is presented to the 
Transaction money module 4 . If the subscriber can sign on 
to the Transaction money module 4, then he/she will be 

25 permitted to change PIN's or reintroduce biometrics. 

In the situation where a subscriber has 
forgotten his/her PIN or had an incident which has 
affected his/her biometric reading, then the subscriber 
may take his/her Transaction money module 4 to a 

3Q participating bank. A special transaction may be executed 
which deposits any electronic notes XX in a holding 
account and destroys the stored bank account numbers. The 
subscriber can now enter new secret sign- on numbers and 
characteristics. Any electronic notes XX that were 

35 removed are returned to the Transaction money module 4 and 
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° the bank account numbers may then be recreated (see Bank 
Access below) . 

It should be noted that it is not a requirement 
for a subscriber to identify himself to the system when he 
takes possession of a Transaction money module 4. Though 
5 the identity of the money module is contained in every 
transaction, the holder of a Transaction money module 4 
can be kept secret. If the relationship is revealed then 
one could trace all of the transactions of a subscriber 
for the period that the relationship can be corroborated. 

10 The only time a subscriber must reveal his identity is if 
he/she links the money module to a bank account or wishes 
to redeem money lost. 

If the subscriber chooses to use the Transaction 
money module 4 only for payments and foreign exchange then 

15 he/she can keep the relationship secret. As may be 

appreciated, the subscriber may also acquire a plurality 
of Transaction money modules 4 and, for example, link one 
to bank accounts and maintain the others for anonymous 
payments. The other Transaction money modules 4 may be 

20 loaded with notes IX by exchanges with other money modules 
or by exchanging for cash notes 11. 

Emplacement of Honey Module Value 
If a Transaction money module 4 malfunctions or 
25 is lost or stolen, it may be possible for the subscriber 
to recoup the value that was stored in the money module at 
the time of the incident. This would necessitate that the 
subscriber relinquish the option of anonymity for that 
money module, since upon making a claim for the lost 
30 money, he/she would have to verify that he/she is the 
owner of the Transaction money module 4. 

To provide for the replacement of electronic 
notes 11, the subscriber may first link his/her 
Transaction money module 4 to a bank account or register 
35 ownership of the Transaction money module 4 with the 
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, Certification Agency 28. After every transaction 
involving the transfer of electronic notes IX, the 
subscriber could save the Tran Log, which identifies the 
counterparty money module identifier and the note 
identifier, to inexpensive, non-volatile storage which is 
removable from the host computing environment. This log . 
may be presented by the subscriber when making a claim to 
replace value. The log may then be compared to 
reconciliation files to determine the true value of the 
lost electronic money. 

An alternative to this procedure would be to 
refresh the money in the Transaction money module 4 
freguently. This would mean that the notes 11 in the 
Transaction money module 4 would be represented by 
transaction records at the Issuing Banks 1. The existence 
of the notes 11 could be verified by scanning these files. 

A third alternative would allow the system to 
capture a money module's Tran log when money is refreshed. 
These records would be copied and routed to Issuing Banks 
1 for storage on their transaction histories. The 
existence of the notes 11 could then be verified as in the 
previous alternative. 

Bank Access 
According to one aspect of the invention, a 
customer's Transaction money module 4 may access his/her 
accounts for deposits, withdrawals, transfers, etc., at 
any bank participating in the system and in particular any 
bank holding an account with the subscriber. For 
instance, a typical subscriber may have a savings account 
and a checking account at one of the participating banks, 
while maintaining a so-called money market account at a 
separate financial institution, and perhaps a credit-line 
account at a third participating bank. It is anticipated 
that a subscriber's Transaction money module 4 will access 
his/her accounts for deposits, withdrawals, loan payments 
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„ and inquiries at any bank or financial institution which 
can be accessed through the Network 25. 



subscriber's account relationships with a bank will be 
stored in an account profile in the To Teller 34 
application of the Transaction money nodule 4. The 
multiple accounts can be linked together by the personal 
account number ("PAN") associated with the individual 
subscriber. 



person, under the control of a bank subscriber service 
representative at a branch, or over the telephone 
utilizing a special dialogue. For example, the subscriber 
may identify himself by his PAN and PIN. He may then 
enter each account number he wishes to access from his 
Transaction money module 4. The account numbers may be 
verified in the bank's account reference files. A cross- 
reference of accounts to Transaction money modules 4 may 
be maintained by each bank if they so choose. 

The composition of an exemplary account profile 



(1) Bank Identifier — one for each bank; 

(2) Account Numbers; 

(3) Account Types — e.g., checking, savings, 
credit; and 

(4) Security Server's 27 signature on the list 
of accounts. 

It will be understood that the list of account 



numbers will be digitally signed by the bank Security 
Server 27. As a further security measure the account 
profile may be re-signed with an updated public key on a 
periodic basis. The fundamental access security is 
provided by the digital signature of the bank's Security 
Server 27. 



Xf a subscriber has multiple accounts, the 



The account profile may be created either in 



20 



may be: 



35 
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Banking System (Accounting Architecture ^ 
It is an notable feature of the preferred 
embodiment, that the method of the system can parallel the 
existing and varying types of accounting methods that 
exist today. The system of the preferred embodiment 
5 follows the various types of accounting methods practiced 
presently in various banks. However, it is important to 
note. that unlike the present banking system, in the 
preferred embodiment of the invention, economic value is 
created on demand. Thus, there is no inventory of cash or 
10 checks involved; electronic currency from demand deposits 
an electronic credit are created on a real-time basis. 
This elimination of a paper inventory by using an 
electronic media of exchange requires certain supplements 
to the commonly practiced accounting techniques to provide 
15 the real-time accounting needed. 

Accordingly, the embodiment of the present 
invention provides an accounting structure to supplement 
those used in the present banking systems 20. The 
improved accounting arrangement may be utilized to monitor 
2o the electronic money and each bank's obligation when a 

financial transaction between a Transaction money module 4 
and a Teller money module 5 occurs, or when a Clearing 
Bank 3 performs any clearing processes. 

When electronic notes II are transferred to or 
25 from a Teller money module 5, in most cases accounting 
transactions affecting the records of the banking system 
20 are created. Conversely, transfers between Transaction 
money modules 4 do not involve any formal accounting 
procedures — they involve only the transfer of electronic 
30 notes 11. 

In the system being described, it is anticipated 
that the following arrangements of accounts are to be 
utilized for each type of bank, categorized under each 
monetary unit: 
35 At an Issuing Bank 1- 
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(1) Honey Issued Account:: A liability account 
which reflects the money issued but not 
cleared. 

(2) Money Due Account: An asset account 
reflecting the money deposited to the 
bank's accounts. 

(3) Deposited at Clearing Bank Account: An 
asset account reflecting the balance of a 
clearing account at a Clearing Bank 3. 

(4) Correspondent Bank Money Account: A 
liability account owned by a Correspondent 
Bank 2 which is drawn upon by the 
Correspondent Bank 2 to dispense electronic 
money. 

(5) Money In Transit Account: A zero-balance 
liability account owned by each bank, which 
is used to temporarily maintain electronic 
money during a financial transaction. 

(6) Foreign Exchange Account: A zero-balance 
liability account owned by each bank, which 
is used to handle multiple currency 
exchanges . 

At a Correspondent Bank 2 - 

CD Deposited at Issuing Bank Account: An 

asset account reflecting the balance of the 
Correspondent Bank 2 account at the Issuing 
Bank 1. 

(2) Money Due Account: An asset 
account reflecting the money 
deposited to the bank's 
accounts. 

(3) Foreign Exchange Account: A zero-balance 
liability account owned by each bank, which 
is used to handle multiple currency 
exchanges. 

(4) Money In Transit Account: A zero-balance 
liability account owned by each bank, which 
is used to temporarily maintain electronic 
money during a financial transaction. 

At the Clearing Bank 3: 

(1) Issuing Bank Clearing Account: A liability 
account to net the amount of money cleared 
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for an Issuing Bank 1. 

The accounts, with their corresponding symbols, 
are summarized below: 



5 


Type of Bank 


Account Name 


Type 


Owner 


Symbo 




Issuing 


Money Issued 


Liability 


Issuing 


MI 






Money Due 


Asset 


Issuing 


MD 






Deposited at 


Asset 


Issuing 


DC 


10 




Clearing Bank 












Correspondent 












Bank Money 


liability 


Correspondent 


CM 






Money In Transit 


liability 


Issuing 


IT 






Foreign Exchange 


Liability 


Issuing 


FX 


15 


Correspondent 


Deposited at 
Issuing Bank 


Asset 


Correspondent 


DI 






Money Due 


Asset 


Correspondent 


MD 






Money In Transit 


Liabihty 


Correspondent 


IT 






Foreign Exchange 


Liability 


Correspondent 


FX 


20 


Clearing 


Clearing Account 


Liability 


Issuing 


CA 



Transaction processing, for a transaction such 
as a request for a withdrawal from savings, selects 
accounting processes so that the appropriate accounts may 
be credited and debited accordingly. It is anticipated 
that the accounting processes will be using software 
programs and methods that are well known in the art and 
presently available; inasmuch as any of the programs and 
methods currently practiced and known for providing the 
foregoing accounting procedures would be suitable for use 
in the invention. To better understand the accounting 
processes of the invention, several examples of typical 
transactions and their associated accounting steps will be 
described. 
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Accordingly, Figures 11-24 illustrate the 
accounting transactions for deposits, withdrawals, foreign 
exchanges, receipt of cleared money, electronic money/ cash 
exchanges, and note 11 updates. Figures 11-14 and 19-22 
also illustrate the accounting flows when a Transaction 
5 money module 4 contains notes 11 that are not involved in- 
the particular transaction that is occurring. The notes 
11 that are not part of the transaction are replaced with 
updated notes as discussed in the security procedures 
described above. For example, when a subscriber deposits 

10 less electronic money than is stored in his/her 
Transaction Money Module 4, leaving a balance, the 
electronic notes 11 representing the balance are then 
replaced with electronic notes 11 containing the most up- 
to-date certificates. This latter case is indicated in 

15 the parenthetical on Figures 20-23 and 28-31. 

in an example of the accounting arrangements 
according to the invention (illustrated by Figure 11), if 
a subscriber were to deposit $50.00 out of $100.00 of 
electronic money contained in his/her Transaction money 

20 modules 4 at a Correspondent Bank's Teller money module 5 
(Step 1) , the entire $100 of electronic money would be 
extracted of which $50.00 would first be credited to 
his/her customer account (herein denoted by "A"), the 
remaining $50.00 would be credited to the Correspondent 

25 Bank's In-Transit account, and $100 would be debited to 
the Money Due account at the Correspondent Bank 2. See 
"IT" and **MD M in Figure 11. 

After the $100 of electronic notes 11 is 
removed, the notes 11 are deposited from the Correspondent 

30 Teller money module 5 to the Teller money module 5 of an 
Issuing Bank 1 (Step 2) . In accomplishing this transfer, 
the Money Due account at the Correspondent Bank 2 is 
credited $100 while its Deposited at Issuing Bank account 
is debited by $100; the Issuing Bank 1 credits its 

35 Correspondent Bank Money account by $100 and debits its 
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> Honey Due account: by $100. 

In Step 3, the updated notes 11 are requested. 
Thus, the Correspondent Bank 2 requests from the issuing 
Bank 1 the withdrawal of $50 of electronic money 
containing the most recent certificates from its Money 
Generator module 6. To support this request, $50 is 
credited to the Deposited at Issuing Bank account and $50 
is debited from its Money In Transit account. The Issuing 
Bank 1 then debits $50 from its Correspondent Bank Money 
account and credits $50 to its Money Issued account. 

To complete the transaction, the $50 is then 
transferred from the Money Generator module 6 to the 
Correspondent Bank's 2 Teller money module 5 through the 
Issuing Bank's l Teller money module 5, and finally to the 
Transaction money module 4 (Steps 4-6) . The net result of 
all of these transactions is that $50 remains deposited in 
the subscriber's account and $50 of newly issued 
electronic notes 11 are now stored in the Transaction 
money module 4 of the subscriber. 

Alternatively, if a subscriber begins with $50 
in his/her Transaction money module 4 and deposits all of 
it, the customer account would be credited $50 and the 
Money Due account would be debited by $50 (Step 1 of 
Figure 11; parenthetical entries). 

When there are only $50 of electronic notes 11 
that are removed, the Correspondent Bank 2 credits the 
Money Due account $50 and the Deposited at Issuing Bank 
account is debited $50 (Step 2, parenthetical entries). 
This money is then deposited at the Issuing Bank 1 for 
later clearing, wherein the Correspondent Bank Money 
account is credited by $50 and the Money Due account is 
debited by $50. Because no updated electronic notes ll 
need be returned in this situation, the deposit , and its 
corresponding accounting is completed at Step 2. 

The accounting processes of an electronic money 
deposit at an Issuing Bank 1 instead of a Correspondent. 
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o Bank involve fewer operational steps, which are 
illustrated in Figure 12. Using the same dollar amounts 
as in the previous exemplary transaction, when $50 of $100 
in electronic money stored in the Transaction money module 
4 are deposited directly to an Issuing Teller money module 
5 (Step 1) , $50 would be credited to the customers account - 
(A) . Fifty dollars would simultaneously be credited to 
the Honey In Transit account, and $100 would be debited to 
the Honey Due account at the Issuing Bank 1. 

Since the entire $100 stored in the Transaction 
10 money module 4 is removed and transferred to the Issuing 
Bank's Teller money module 5, it is necessary to return 
$50 of updated notes to the Transaction money module 4. 
Accordingly, as shown in Step 2 the Teller money module 5 
requests $50 from its Honey Generator module 6, debiting 
^5 its Honey In Transit account by $50 and crediting its 
Honey Issued account by $50. 

In response, $50 is created by the Honey 
Generator module 6 and transferred to the Teller money 
module 5, which in turn transfers this electronic money to 
2 0 the Transaction money module 4 (Step 3-4) . 

When only $50 is stored in the Transaction money 
module 4 and all of it is deposited, the customer's 
account (A) is credited $50, the Honey Due account is 
credited $50, and that is the end of it. See 
25 parenthetical entries in Step 2 in Figure 12. 

In the case of a withdrawal from a Correspondent 
Bank (see Figure 13) , a withdrawal request of $100 by a 
subscriber using a Transaction money module 4 at a 
Correspondent Bank 2 will cause the subscriber's account 
30 (A) to be debited by $100 and the Correspondent Bank's 2 
Honey In Transit account to be credited by $100 (Step 1>. 
The request for the $100 withdrawal is forwarded to the 
Issuing Bank 1 from the Correspondent Bank 2, and the 
Correspondent Bank's Deposited at Issuing Bank account is 
35 credited by $100 while its Honey In Transit account is 
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- debited by $100 (Step 3). 

Next, the request for $100 is forwarded by the 
Issuing Bank's 1 Teller money module 5 to the Money 
Generator module 6. Accordingly, the Correspondent Bank 
Money account gets a $100 debit while the Money Issued 
5 account gets a $100 credit (Step 4) . 

The Money Generator module 6 then creates the 
$100. of electronic notes 11, and transfers it to the 
Transaction money module 4 via the Issuing Bank's 1 Teller 
money module S and the Correspondent Bank's 2 Teller money 
10 module 5 (Steps 5-6) . 

When, e.g., the subscriber makes the $100 
withdrawal request with a Transaction Money Module 4 that 
contains $50 of electronic notes 11, the notes 11 are" 
removed and now the Money Due account is debited $50, the 
15 subscriber's account is still debited $100, and the Money 
in Transit account is credited $150 (parenthetical 
entries, Step 1) . 

The $50 is then deposited to an Issuing Bank 1, 
causing the Money Due account to be credited $50 and the 
20 Deposited at Issuing Bank account to be debited by $50. 
At the Issuing Bank 1, the Correspondent Bank Money 
account is credited $50 while the Money Due account is 
debited $50 (Step 2, parenthetical entries). 

Because $50 of notes 11 have been removed, the 
25 withdrawal request in Step 3 must be for $150. This 

request causes the Deposited at Issuing Bank account to be 
credited by $150 and the Money In Transit account to be 
debited by $150 (Step 3 parenthetical entries). 

At the Issuing Bank, $150 is requested from the 
30 Money Generator Module 6 and the Correspondent Bank Money 
account gets a $150 debit while the Money Issued account 
gets a $150 credit (Step 4 parenthetical entries) . As 
above, the money generated by the Money Generator Module 6 
($150) gets conveyed to the Transaction money module 4 via 
35 the Issuing Bank 1 and Correspondent Bank 2 Teller money 
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modules 5 (steps 5-6, parenthetical entries). 

A withdrawal from an Issuing Bank 1 involves 
fewer accounting procedures. Referring now to Figure 14, 
a withdrawal request by a Transaction money module 4 from 
an Issuing Bank 1, Step 1 will cause the Issuing Bank X 
Teller money module 5 to debit the subscriber's account . 

(A) by $100 and credit its Money Issuing account by $100 

(Step 1-2) . 

A request for an updated $100 is then made by 
the Issuing Bank's 1 Teller money module 5 to the Money 
Generator module 6, which upon its creation will return 
$100 to the Issuing Bank's Teller money module 5 (Step 3). 
In completing the transaction, the Issuing Bank's 1 Teller 
money module 5 simply transfers this $100 containing the 
most recent certificate to the Transaction money module 4 
(Step 4) . 

Alternatively, when the Transaction money module 
contains $50 at the time of the §100 withdrawal , 
(parenthetical entries) the $50 will be removed, the 
Issuing Bank's Money In Transit account will be credited 
$50 and the Money Due account will be debited $50 (Step 
D- 

The Issuing Bank 1 must now request $150 from 
the Money Generator module 6. Naturally, the customer's 
account is debited $100. The Money Issued account is 
credited by $150 when the new notes 11 are created, and 
the Money In Transit account is debited $50 (Step 2) . 
From there, $150 is returned to the Transaction money 
module 4 via the Issuing Bank's 1 Teller money module 5 
(Steps 3-4). 

Figure 15 illustrates the case of a foreign 
exchange with an Issuing Bank 1. In this example, a 
subscriber wishes to exchange $100 of electronic money 
stored in his/her Transaction money module 4 for £60 of 
British currency. The deposit at the Issuing Bank's 1 
Teller money module 5 will cause the Issuing Bank's l 
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o Foreign Exchange account to be credited by £60, while its 
Money Due account would be debited by $100 (Step 1) . 
Here, the $100 is transferred from the Transaction money 
module 4 to the Teller money module 5, which then requests 
that an electronic note 11 representing £60 be created by 
5 the Honey Generator module 6 (Step 2) . 

At the Issuing Bank 1, the foreign exchange 
account is now debited by £60 while the Honey Issued 
account is credited by £60. The £60 electronic note 11 
created by the Money Generator module 6 is transferred to 

^ Q the Teller money module 5, which now stores both the $100 
and the £60 (Step 3) . The £60 is then transferred from 
the Teller money module 5 to the Transaction money module 
4 resulting in a net balance of £60 in the Transaction 
money module 4 and $100 remaining in the Teller money 

5 module 5, completing the transfer (Step 4). 

The accounting procedures for a foreign exchange 
of $100 for £60 at a Correspondent Bank 2 are shown in 
Fig. 16. The Transaction money module 4, in this example, 
requests that its $100 be used to "purchase" £60 from the 

q Correspondent Bank's Teller money module 5, which causes 
the Correspondent Bank's Foreign Exchange account to be 
credited by £60 while its Money Due account is debited by 
$100 (Step 1). The $100 stored in the Transaction money 
module 4 is transferred to the Correspondent Bank's 2 

5 Teller money module 5, which sends a request to the 
Issuing Bank's 1 Teller money module 5 to withdraw £60, 
and debits its Foreign Exchange account by £60 and credits 
its Deposited at Issuing Bank account by £60 (Step 2). 

The corresponding account transaction at the 

Q Issuing Bank 1 debits the Correspondent Bank Money account 
by £60 and credits the Money Issued account by £60 (Step 
3). The Issuing Bank's Teller money module 5 then 
requests that the Money Generator module 6 create £60 and 
transfer it to the Issuing Bank's Teller money module 5, 

. which in turn transfers it to the Correspondent Bank's 2 
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° Teller money nodule S (Steps 4-5) . From 'there, the £60 
note IX is transferred to the Transaction money module 4, 
leaving it with a balance of £60 while the Correspondent 
Bank's 2 Teller money module S finishes with a balance of 
$100 (Step 6) . 

5 The accounting transactions for a withdrawal or 

deposit of credit notes 11 also involve several accounting 
operations, as shown in Figure 17. When a subscriber 
wishes to withdraw money from his/her credit line (Step 
1) , the proper credit note IX is simply transferred from 

10 the Money Generator module 6 to the Transaction money 
module 4, reducing the customer's credit line by an equal 
amount to the amount transferred (Steps 2-4) . 

Alternatively, when credit notes XX are 
deposited by a subscriber's Transaction money module 4, 

15 the subscriber's account is increased by the amount 
deposited, and the Money Due account is debited by an 
equal amount (Step 1) . 

The accounting operations involving the Issuing 
Bank's 1 receipt of cleared electronic money will now be 

2Q described. Referring to Figure 18, in this example $100 
of electronic money and $100 of credit notes XX have been 
cleared by the Clearing Bank 3 to settle the balances 
among several Issuing Banks 1. The $100 of electronic 
money and the $100 of credit notes are transferred to the 

25 proper Issuing Bank 1 (Step 1). Additionally, $50 of 

electronic notes XX that it has issued are also deposited 
at the Issuing Bank X. Consequently, the Issuing Bank 1 
will debit the subscriber's account A by $100, debit the 
Issuing Bank's Money Issued account by $150, credit the 

30 Money Due Account by $50 and credit the Issuing Bank's 

Deposited at Clearing Bank account by $200 to complete the 
transaction . 

Turning now to Fig. 19, an accounting example of 
an exchange of cash for electronic notes XX at an Issuing 
35 Bank X is shown. In this example, the subscriber wishes 
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u to exchange $50 of cash for $50 of electronic notes IX to 
add to the $100 of electronic notes 11 already stored in 
his/her Transaction money module 4. 

In the first transaction, the $50 of cash is 
deposited at the Issuing Bank 1 which causes the Money In 

5 Transit account to be credited by $50, while the cash 
account is debited by $50 (Step 1) . 

Next, the $100 of electronic notes 11 in the 
Transaction money module 4 is removed, resulting in the 
Money In Transit account being credited by $100, while the 

( Money Due account is debited by $100 (Step 2) . 

The Teller money module 5 will now request $150 
of electronic notes 11 from the Money Generator module 6 
to return $150 of electronic notes 11 to the subscriber 
(Step 3) . Accordingly, the Money In Transit account is 
debited by $150 while the Money Issued account is credited 
by $150. 

The newly generated $150 of electronic notes 11 
is then transferred from the Money Generator module 6 to 
the Teller money module 5, who in turn transfers the $150 
to the subscriber's Transaction money module 4 (Step 4-5). 
The completed transaction leaves the subscriber with $150 
of electronic notes 11 and the Issuing Bank's Cash account 
containing a $50 balance. 

Also shown parenthetically in tig. 19 is the 
case when the subscriber exchanges $50 of cash for 
electronic notes 11 when there is a zero balance in 
his/her Transaction money module 4. In Step 1, the $50 of 
cash is deposited at the Issuing Bank 1 which causes the 
Money In Transit account to be credited by $50, while the 
cash account is debited by $50. Since no notes ll are 
removed, no accounting is performed in Step 2. 

m Step 3, only $50 is requested from the Money 
Generator module 6, and the Money In Transit account is 
debited by $50 while the Money Issued account is credited 
by $50. The same transfer between money modules occurs as 
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o in Steps 4-5 of Fig. 19 described above, using only the 
$50 that was requested. This would leave the subscriber 
with $50 of electronic notes 11 in lieu of his original 
$50 of paper money. 

. In Fig. 20, an exchange of cash for electronic 
5 notes 11 at a Correspondent Bank 2 is shown. This example 
uses the same parameters as in Figure 19, namely, the 
subscriber has $50 of cash and $100 of electronic notes 11 
in his Transaction money module 4. 

When the $50 in cash is deposited to the 
1Q Correspondent Bank 2, its Honey In Transit account is 
credited $50 while its Cash account is debited $50 (Step 
1) . The $100 of electronic notes 11 is then transferred 
from the Transaction money module 4 to the Correspondent 
Bank 2 which credits its Money In Transit account by $100 
15 and debits its Honey Due account by $100 (Step 2) . 

From there, the $100 of electronic notes 11 is 
deposited at the Issuing Bank 1, wherein its Honey Due 
account is debited by $100 while its Correspondent Bank 
Honey account is credited by $100 (Step 3) . At the 
Correspondent Bank 2, the Deposited at Issuing Bank 
account is debited by $100 while the Honey Due account is 
credited by $100. 

A withdrawal request is then made by the 
Correspondent Bank 2 for $150 from the Issuing Bank 1 
(Step 4) . This request results in the Correspondent Bank 
2 debiting its Honey In Transit account by $150 and 
crediting its Deposited at Issuing Bank account by $150. 

Correspondingly, the Issuing Bank 1 Teller money 
module 5 requests $150 of notes ii from the Honey 
3Q Generator Hodule 6, debits its Correspondent Bank Honey 
account by $150 and credits its Honey Issued account by 
$150 (Step 5). 

Finally, the $150 of electronic notes 11 is 
transferred from the Honey Generator module 6 to the 
Issuing Bank«s 1 Teller money module 5 which transfers it 
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« to the Transaction money module 4 after passing through 
the Correspondent Bank's 2 Teller money module 5 (Steps 6- 
8) . 

Alternatively, a subscriber having only $50 of 
cash and no notes 11 in his/her Transaction money module 4 
5 is also shown in Fig. 20. As in the first case, the $50 . 
in cash is deposited to the Correspondent Bank 2, its 
Money in Transit account is credited $50 while its Cash 
account is debited $50 (Step 1) . 

A $50 withdrawal request is then made to the 
IQ Issuing Bank 1, and the Money In Transit account is 

debited by $50 while the Deposited at Issuing Bank account 
is credited $50 (Step 4 , parenthetical entry) . 
Thereafter, $50 is requested from the Money Generator 
Module 6, the Correspondent Bank Money account is debited 
15 $50 and the money issued account is credited $50 in Step 5 
(parenthetical entry). Here, $50 in electronic notes 11 
are transferred through the same money module path as 
Steps 6-8 above, to reach the Transaction money module 4. 

Figure 21 illustrates the exchange of electronic 
20 notes 11 for cash at an Issuing Bank 1. Here the 

subscriber has $100 of electronic notes 11 stored in 
his/her Transaction money module 4 and wishes to exchange 
$50 of the electronic notes 11 for $50 of paper cash. 

After the Transaction money module 4 establishes 
25 the communications with the issuing Bank's 1 Teller money 
module 5, all $100 of the electronic notes 11 is removed 
from the Transaction money module 4 (Step 1) . This causes 
the Money In Transit account to be credited by $100 and 
the Money Due account (at the Issuing Bank 1) to be 
30 debited by $100. 

The Teller money module 5 then requests $50 of 
updated electronic notes 11 from the Money Generator 
module 6, and this transaction requires the Money In 
Transit account to be debited by $50 and the Money Issued 
35 account to be credited by $50 (Step 2) . The newly 
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- genera-ted $50 of electronic notes 11 is then transferred 
to the Transaction money module 4 through the Teller money 
module 5. The $50 of paper cash is then transferred to 
the subscriber through a Teller or ATM (Steps 3-5) . 

Also shown in this figure (parenthetically) is 
5 the subscriber making the same exchange for cash when only 
$50 is stored in his/her Transaction Money Module «. At 
the Issuing Bank, $50 of electronic notes 11 is removed 
for which the Money In Transit account is credited $50 and 
the Money Due account is debited $50. Fifty dollars of 
IQ paper cash is then returned to the subscriber since he/she 
only deposited $50 of electronic notes 11 (Step 5) . 

Completing this transaction, in both cases the 
Money In Transit account is debited by $50 while the cash 
account at the Issuing Bank 1 is credited by $50. The net 
15 result is that the subscriber ends up with $50 of paper 
cash and, in the former case only, $50 of updated 
electronic notes 11 in his/her Transaction money module 4. 

The exchange of electronic notes 11 for paper 
cash at a Correspondent Bank 2 is illustrated in Figure 
2o 22. As in the example illustrated in Figure 21, although 
the subscriber is only exchanging $50 of electronic notes 
11, all $100 of electronic notes 11 are transferred from 
the subscriber's Transaction money module 4 (Step 1). 
After the notes 11 are transferred, the 
25 Correspondent Bank's 2 Teller money module 5 credits its 
Money In Transit account by $100 and debits its Money Due 
account by $100. This $100 of electronic notes 11 is now 
deposited at an Issuing Bank 1, causing the Correspondent 
Bank 2 to credit its Money Due account by $100 while 
30 debiting its Deposited at Issuing Bank account by $100 
(Step 2). 

At the Issuing Bank 1, $100 is credited to the 
Correspondent Bank Money account while $100 is debited to 
the Money Due account. The Correspondent Bank 2 now makes 
35 a request to withdraw $50 of electronic notes 11 from the 
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j Issuing Bank 1 (Step 3). Consequently, the Deposited at 
Issuing Bank account is credited by $50 while the Money In 
Transit account at the Correspondent Bank 2 is debited by 
$50. 

Now, the Issuing Bank's 1 Teller money nodule 5 
. request $50 from the Honey Generator module 6 and debits 
its Correspondent Bank Money account by $50 while 
crediting its Money Issued account by $50 (Step 4) . The 
$50 of updated electronic notes 11 is transferred from the 
Money Generator module 6 through Issuing Bank 1 Teller 
money module 5 and the Correspondent Bank 2 Teller money 
module 5, back to the Transaction money module 4 in Steps 
5-7. 

Also illustrated is this same example with only 
$50 stored in the Transaction money module 4, which is 
deposited at a Correspondent Bank 2 , to be exchanged for 
' paper money. For this deposit, the Money In Transit 
account is credited $50, and the Money Due account is 
debited $50 (Step 1) . The $50 is then deposited by the 
Correspondent Bank 2 to its account at the Issuing Bank 1. 
At the Correspondent Bank 2, the Money Due account 
receives a $50 credit, while the Deposited at Issuing Bank 
account receives a $50 debit. On the Issuing Bank 1 side, 
it credits the Correspondent Bank Money account by $50 and 
debits the Money Due account by $50 after receiving the 
$50 deposit (Step 2) . 

In both illustrations, fifty dollars of paper 
cash is then transferred from the Correspondent Bank 2 to 
the subscriber, while the Correspondent Bank 2 debits its 
Money In Transit account by $50 and credits its cash 
account by $50 (Step 8) . The subscriber is now left with 
$50 of paper cash and, in the first illustration, $50 of 
electronic notes 11 stored in his/her Transaction money 
module 4. 

Figure 23, the accounting process for clearing 
the electronics money issued by different Issuing Banks is 
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„■ shown. This illustration uses an example in which $100 of 
electronic notes 11 issued by Bank B has been deposited at 
Issuing Bank A, and $150 of electronic notes 11 issued by 
Bank A have been deposited at Issuing Bank B. 

In Step 1, Issuing Bank A transfers the $100 
5 issued by Bank B to the Clearing Bank 3. It then credits 
its Honey Due account and $100 and debits its Deposited at 
Clearing Bank account by the same amount. In Step 2, 
Issuing Bank B deposits the $150 of Issuing Bank A's money 
at the Clearing Bank 3. Its Money Due account is credited 

1Q by $150, while its Deposited at Clearing Bank account is 
debited $150. 

In sum, $50 is due to Bank B. Accordingly, $50 
gets debited to the Clearing account of Bank A, while $50 
gets credited to the Clearing account of Bank B (Step 3). 

15 In Figure 24, the accounting transactions 

corresponding to updating electronic notes 11 is shown. 
Here, $100 of electronic notes 11 are stored in a 
Transaction money module 4 and are transferred to an 
Issuing Bank 1, where $100 is credited to the Money In 

2Q Transit account and $100 is debited to the Money Due 
account (Step 1) . 

one hundred dollars of electronic notes 11 are 
requested from the Money Generator module 6 causing the 
Money In Transit account to be debited by $100 while the 

25 Money Issued account is credited by $100 (Step 2) . With 
this accomplished, the $100 of electronic notes 11 is 
transferred from the Money Generator module 6 to the 
Issuing Bank's 1 Teller money module 5, which in turn 
transfers the money to the subscriber's Transaction money 

3Q module 4 (Steps 3-4}. 

Reconciliation and Clearing Systems 
Referring to Figure 25, the Transaction 
Reconciliation System 22 is shown. It will be understood 
that the Teller money modules 5 , the Money Generator 
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modules 6 and the banking system 20 may periodically pass 
transaction records to a Transaction Reconciliation System 
22 maintained at each participating bank. These 
transactions will be analyzed and matched to determine if 
there is any faulty process occurring in the system 20 of 
the invention. 

The Transaction Reconciliation System 22, which 
may be embodied in any appropriately sized and suitably 
programmed general purpose computer but is not so limited, 
will ensure that all Teller money module 5 transactions 
with a financial impact, e.g., deposits, and withdrawals 

1 and payments, match the appropriate accounting 
transactions. Any mismatches could indicate incomplete 
transactions or possible fraudulent actions. 

Transactions reflecting the money issued by the 
Money Generator modules 6 also should correspond to Teller 

1 money module 5 transactions and have the appropriate 
accounting transactions recorded. Any mismatched data may 
indicate incomplete processing or a security breach. 
Unmatched accounting transactions may be caused by 
incomplete transactions or an attempt to tamper with the 

1 records of the banking system 20. 

In the preferred embodiment, these unmatched 
transactions may then be transferred to an investigation 
system 12 where the causes of the problems may be 
determined. On-line dialogues may be provided to allow 
investigators to review the mismatches against transaction 
records and to determine appropriate actions to correct 
the situation. Investigators may then take corrective 
actions by adjusting accounts, deactivating faulty Teller 
money modules 5 and Honey Generator modules 6, and 

1 notifying subscribers of the actions. 

Attention is now directed to Figure 26, which 
illustrates the clearing process for handling deposit 
transactions. Correspondent Banks are not involved in 
this process because subscriber deposits are deposited to 



PCI7US92/09732 



o -their- accounts at Issuing Banks 1 on a real-time basis. 
At Issuing Banks , deposits are aggregated by the Clearing 
System 13 to consolidate all deposited electronic money 
(including the deposits from Correspondent Banks) for 
transmission to the Clearing Bank 3. 

5 The Clearing Bank 3 may be implemented in any 

computer processing facility capable of accommodating the 
large number of transactions and corresponding amounts of 
data which the system will typically handle. A high 
volume, mainframe computer, a suitably sized minicomputer 
1Q system, a number of networked work stations having the 
necessary data processing capabilities or combination of 
the foregoing may also be used. As will be appreciated by 
a person skilled in the art, the particular design of the 
Clearing Bank 3 hardware system is not critical to the 
15 invention. 

It is anticipated that Issuing Banks 1 may clear 
money in one of several procedures. In one of these 
procedures, electronic money may be deposited on-line from 
the Issuing Bank 1 to the Clearing Bank 3. This could be 

„ done on-line in a real-time mode when transactions are 

20 

actually occurring. Alternatively, an Issuing Bank 1 may 
record the details of transactions being performed during 
the course of the day for later batch processing. 
Interbank processing could occur several times a day. 

25 As shown in Figure 26, an Issuing Bank 1 may 

periodically transfer its electronic money to a deposit 
consolidation file (consolidate deposits) which may be 
processed and transmitted to the Clearing Bank -3. 
Transaction records from this file are also conveyed to 

3Q the bank's Transaction Reconciliation system 22 for 
statistical and housekeeping functions. 

At the Clearing Bank 3, the deposit 
consolidation files are processed creating a single debit 
and credit by the monetary unit for each Issuing Bank's 1 
demand account. Of course, the appropriate accounting 
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u transactions for these demand accounts are posted during 
the clearing processes. Any accounts which are overdrawn 
will toe settled via the usual interbank settlement 
processes that are commonly used in the industry. 

The processed electronic money that is cleared 
5 is sent back to the Money Issued Reconciliation System 23 
of each of the banks that issued it in order to be 
reconciled and checked for tampering and duplication. 

Additional statistical and housekeeping 
functions are implemented in the Money Issued 

10 Reconciliation System 23, as shown in Figure 27. Issuing 
Bank's 1 provide their own Money Issued Reconciliation 
System 23, typically embodied in a general purpose 
computer but not so limited, for matching the electronic 
money issued to the electronic money cleared at the 

15 Clearing Bank 3. 

As indicated in Figure 27, the electronic money 
issued and electronic money deposited at Issuing Banks 1, 
and money cleared transactions received from clearing bank 
3 are conveyed to the Money Issued Reconciliation system 

20 23. The Money Issued Reconciliation system 23 generates 
accounting transactions for the money cleared, and updates 
a master file of all the bank's money issued. 
Additionally, the Money Issued Reconciliation system 23 
passes to an investigation subsystem 13 money which has 

25 cleared but which was not issued or was possibly 
transferred more than once. 

Any unmatched cases may indicate a potential 
breach of security. Investigators may then determine 
whether Money Generator modules 6 are not working properly 

30 or money modules are being tampered with. Money module 
identifiers of faulty or abused money modules are passed 
to each bank's Security Servers 27 for distribution to the 
other money modules on the bank's local network 18. The 
identifiers are also sent to the Certification Agency 28 

35 for appropriate distribution throughout the Network 25. 



PCT/US92/09732 



» Separately, the Money issued master file is 

accessed by the Money Position system 24 which creates a 
file to be transmitted to the Clearing Bank 3 to create a 
consolidated money position. It is contemplated that all 
issuing Banks 1 will provide a report reflecting their 
5 position at the end of a specified period, typically at - 
the end of every day. The Money Position System 24 may 
consolidate these reports to reflect the amount of money 
issued by the Issuing Banks 1 for each monetary unit. The 
reports will reflect the outstanding position of each 
1Q Issuing Bank 1 in order to assess the risk of interbank 
settlement problems. 

Operational Sequences 
Although some aspects of the preferred 

15 embodiment may be described in terms of detailed schematic 
diagrams, the transaction functions are best illustrated 
by use of process flowcharts. Thus, to facilitate 
understanding of the operation of the money modules, 
several examples of transactions are set forth in the 

2Q flowcharts of Figures 28-50A. Referring to these figures, 
a detailed description of the system processes and the 
associated application functions that incorporate the 
principles of the preferred embodiment of the present 
invention will now be described. 

25 Throughout the descriptions of the flowcharts 

(except where indicated otherwise) , the application 
functions of the Transaction money module 4, whether they 
are imbedded in a hand-held unit or other type of 
processing device, are hereinafter designated with the 

3Q suffix "A", and the Teller money module 5 applications and 
its associated bank are hereinafter designated with the 
suffix n B". In the case where a Correspondent Bank 2 
interacts with an Issuing Bank 1, the Issuing or 
Correspondent Bank 1 and its associated Teller money 

35 module 5 applications are hereinafter designated with a 
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Additionally, transitions to steps in another 
figure are indicated by a pentagonal tag having an 
alphanumeric symbol, and continue on the other figure with 
a circle having the same alphanumeric symbol therein. 

Withdrawal From An Issuing Bank 

In Figures 28-35A, a process flowchart of a 
transaction between a Transaction money module 4 and an 
( Teller money module 5 is shown. In this process example, 
it is assumed that the subscriber is desirous of 
completing a monetary transaction with a participating 
bank; specifically, a withdrawal of some amount of 
electronic money from his/her account, to be stored in 
his/her Transaction money module 4. 

The process flow to set up a withdrawal 
transaction begins at the top of Figure 28. The first 
flow bock is a withdrawal set up between a money module A 
and a bank's Teller money module B 5, which is described 
further in Figure 29. This process begins with money 
module A performing a sign-on process that is also 
described in further detail in another figure, 
specifically Figure 31. 

Subscriber Sign-On 

Referring to the top of Figure 31, the 
subscriber prompts his/her Transaction money module 4 to 
perform a sign-on function (Step 10) . The Session Manager 
31 application receives the sign-on message (Step 12) and 
checks to see if the Transaction money module 4 has 
inhibited subscribers from signing on (Step 14). 

Subscriber sign-on may be inhibited if a user 
makes several unsuccessful attempts to sign-on to the 
Transaction money module 4. For example, the allowable 
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» attempts to sign-on may be limited to three, such that if 
a person makes more than three consecutive unsuccessful 
attempts to sign-on to the Transaction money module 4, the 
Session Manager 31 will prohibit any further sign-on 
attempts. Additionally, this w lock-out n feature may be 

5 maintained for any predetermined time period, such as 
twenty- four hours, for example. Such an arrangement will 
provide security from persons who come into possession of 
the Transaction money module 4 but who are not properly 
authorized to access it. It should be noted that 

0 while this type of an arrangement is anticipated in the 
preferred embodiment of the invention, the invention 
should not be limited as such, since any of the methods 
known in the industry for providing security from 
unauthorized persons would be suitable for use herein. 



typically be the case. To Subscriber 33 prompts the 
subscriber to enter his/his sign-on characteristics, such 
as his/her PIN and biometric identifiers (Step 22) . 
Inputs from the subscriber are forwarded through the 
Session Manager 31 to the To Subscriber 33 application 
(Steps 24-28) , which responds to the characteristics 
entered and entitles the subscriber to operate the 
Transaction money module 4 if the subscriber's 
identification characteristics are the correct ones when 
compared to those stored in the memory of the Transaction 
money module 4 (Steps 30-32) . 



characteristics do not match the identifiers stored in 
memory, the To Subscriber 33 application notifies the 
subscriber of the invalid sign-on condition (Step 34) . 
From there, the To Subscriber 33 application checks to see 
how many times the user has attempted to sign-on (Step 
36} , and if the predetermined count has not been reached, 
the Session Manager 31 is notified (Step 38) . 



15 



When the sign-on is not inhibited, as will 



if the subscriber's identification 



35 



The Session Manager 31 works in conjunction with 
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» the Clock/Timer 43 application to set and to monitor the 
time that has elapsed between unsuccessful sign-on 
attempts (Step 40) . In one embodiment, too many 
unsuccessful attempts within the set time period will 
cause the Session Manager 31 to prohibit any further sign- 
5 on attempts, effectively shutting down the Transaction 
money module 4. The Session Manager 31 notes that the 
sign. on is terminated in Step 42. 

Turning back to Step 14 of Figure 31, assuming 
that the Transaction money module 4 is inhibited, the 

10 Session Manager 31 checks to see if the predetermined time 
period has expired (Step 16) . If the Transaction money 
module 4 is still in the prohibited sign-on mode, the To 
subscriber 33 sends a message to the subscriber that 
further access to the Transaction money module 4 is 

15 prohibited (Steps 18-20) . The Session Manager 31 notes 
that the sign-on attempt is terminated, again in step 42. 

Setup Withdrawal 

2o Turning to Figure 29, when a proper sign-on is 

accomplished, the To Subscriber A 33 prompts the 
subscriber for the type of transaction that is desired 
(Step 43). As mentioned previously, it is anticipated 
that a subscriber may transact with any one of a multitude 

2 5 of accounts at several different participating banks and 
financial institutions. 

After selecting the particular bank and account 
(Step 44) , the Transaction money module 4 initiates a 
procedure for communicating with the bank that was 

30 selected, by engaging the Network 25. The overall program 
flow now passes to the procedures illustrated by 
flowcharts in Figure 33. In Figure 33, there is shown the 
data processing and flow for implementing a sign-on to the 
Network 25. 



35 
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» Network Sign-On 

The illustrative Network 25 sign-on method about 
to he described is in general applicable to any of the 
money modules 4,5,6 of the present embodiment. Thus, in 
5 this example, "A" denotes any class of money module. 

After the bank that is to be accessed is 
selected, the money module initiates communication with 
the Network 25 under the control of its Session Manager A 
31 (Step 50) . The Network Server 26 begins by requesting 

IQ the certificate of the Transaction money module 4 from 

Session Manager A 31 (Step 52-54). The Maintain Security 
A application 37 retrieves and sends the certificate to 
Session Manager A 31 (Step 56) . Session Manager A 31 
sends the certificate to the Network Server 26 (Step 58) , 

15 which, upon receipt, routes it to the Security Server 27 
(Step 60). 

The Security Server 27 tests the certificate to 
check its validity (Step 62-64) , and if it is not valid 
for any reason, the Security Server 27 will signal the 
2 0 Network Server 26 to deny access (Step 66) . The Network 
Server 26 may in turn convey an access-denied message to 
Session Manager A of the Transaction money module 4 (Step 
68-70) . 

If the Session Manager A that receives the 
25 denied access message is a Transaction money module 4, its 
To subscriber application A will inform the subscriber of 
this condition (Step 74) . If it is a Teller money module 
5 or Money Generator Module 6 that is trying to access the 
Network 25, the To Bank A application 47 notifies the 
30 bank's systems 20 that its access will not be permitted 
(Step 76) . 

Assuming the certificate validity check is 
satisfied, the Security Server 27 sends an updated list of 
the bad money modules, and a new list of cert if icatory 
35 keys to the Session Manager A, (Step 78, Fig. 33A) . The 
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° keys are signed using the last version of the 
certificatory key. This information is received by 
Session Manager A and forwarded to the Maintain Security A 
37 application, which will validate the certificatory key 
list and the bad money module list (Steps 80-82, Fig. 

5 33A). 

Public Key A 44 tests the validity of the 
signature (Step 84) and if the signature is not valid, a 
message warning of a network security problem is sent by 
the To Subscriber application A 33 of a Transaction money 

10 module 4 (Steps 86-90), or alternatively, by the To Bank 
application A application of a Teller money module 5, 
(Steps 86-88, 92). Advantageously, all money modules will 
check the validity of a signature received from even the 
Security Server 27. This helps to ensure the integrity of 

15 the overall system. 

In the case of a valid signature. Maintain 
Security A updates the bad money module list and the 
certificatory key list. (Step 94). If the certificate is 
to be recertified or the certificate has expired (Steps 96 

20 and 98) , the Maintain Security A generates a new 

certificate (Step 126 of Figure 33C) while Public Key A 
generates new keys and signs the certificate using the old 
public key (Step 128) . Session Manager A sends the new 
certificate to the Security Server 27 who takes the 

25 certificate and tests the validity of the signature (Steps 
130-136). 

Assuming that the signature of the new 
certificate is not valid at this stage. Steps 66-76, Fig. 
33, are repeated so as to terminate the communication link 
30 into the Network 25. 

On the other hand, a valid signature, Fig. 33C, 
will allow the Security Server 27 to sign the new 
certificate and send it back to the money module (Step 
138). Session Manager A 31 receives the new certificate, 
35 step 140, Fig. 33D, and forwards it to its Maintain 
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° Security application A to again validate the certificate 
through use of the Public Key application (Steps 142-146) . 
Here, the money nodules will repeat the test of the 
validity of the certificate issued from the Security 
Server 27. For a valid signature, the Session Manager A 

5 3X sends an acknowledgment to the Security Server 27 (Step 
148) who responds by returning the process to Step 78, 
Fig. .33A. 

Conversely, if the Security Server* s signature 
on the new certificate generated by Transaction money 
10 module A proves to be invalid. Fig. 33D, Session Manager A 
will send an invalid certificate message along with the 
certificate back to the Security Server 27 (Step 150) , 
which will again attempt to validate the signature on the 
certificate (Step 152) . A valid signature will return the 

15 process to Step 66, Fig. 33. Alternatively, an invalid 
signature will cause the Security Server 27 to disconnect 
from the Network 25 (Step 156, Fig. 33D) and cause the 
Network Server 26 to notify the money module of a 
malfunction (Step 158). 

20 Tne Session Manager A that receives the message 

(Step 160) will, in the case of a Transaction money module 
4, get the To Subscriber A 33 to inquire of the subscriber 
if they desire to retry the whole process of signing on to 
the Network 25 (Step 164 & 168). In the case of a Teller 

25 money module 5 or a Money Generator Module 6, the To Bank 
application A will inquire if there is a request to retry 
the Network 25 sign-on procedure (Step 166 & 168). 

No attempts for a retry will, of course, end the 
communication link into the Network 25, and conversely, a 

30 request for retry of Network 25 access will return the 
procedure back to Step 56, Fig. 33, wherein Maintain 
Security A will again retrieve the Transaction money 
module's certificate for the Network Server 26. 

Back at Step 98, Fig. 33A if the certificate 

35 does not need to be recertified or has not expired. 
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" Session Manager A 31 will request the date and time (Step 
100) from Clock/Timer A (Step 102, Fig. 33B) , and forward 
this data to the Network Server 26 (Step 104) . 

The Network Server 26 checks the time and date 
after receiving it (Step 106) and if it is outside of an 
5 acceptable predetermined parameter, the Network Server 26* 
will send the new time and date (Step 110) to Clock/Timer 
A through Session Manager A (Steps 112 & 114). if 
Clock/Timer A 43 cannot adjust the date and time to be 
synchronized with the Network 25, the operator of the 
10 money module for subscriber or the bank is notified of the 
clock malfunction (Step 116-124) . 

In response to the apparent malfunction, the 
operator may attempt to have the time and date resent from 
the Network Server 26, Step 124, and the procedure reverts 
15 back to Step 102 in which it attempts to send the new date 
and time to the money module. Alternatively, an 
acceptable date and time check, Step 108 allows the 
Network Server 26 and Session Manager A to exchange 
acknowledgements and note the successful Network 25 sign- 
20 on (Step 126-128). 

Establishing A Session 

As shown in Figure 29, after the steps of money 
25 module sign-on, transaction selection and network sign-on 
are completed, sessions are established between the money 
modules. Figure 34 diagrams the flow process for 
establishing a money-module to money-module session, 
which, as will be understood by one skilled in the art, 
30 will in general be applicable as well to other sessions 
established between the various types of money modules of 
the present invention. 

Referring to the top of Figure 34, the Session 
Manager A will first check to see if the subscriber has 
35 requested connection to a specific destination in the 
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o Network 25. (Step 190). For instance, where a subscriber 
is desirous of transacting with his/her account at a 
specific bank, the Network 25 will connect the Transaction 
money module 4 to the selected bank, Steps 192-198.. 
Conversely, when a subscriber is performing updating 
5 functions on the Network 25, there is no need to establish 
a session with any specific bank, and the Network server 
26 may decide where to route the connection, based on 
Network 25 traffic. 

If a specific destination has been selected by 

10 the subscriber. Session Manager A conveys the destination 
information to the Network Server 26 (Step 194) . The 
Network Server 26 initiates a communication link to the 
money module of the selected destination (Step 196) and 
sends an acknowledgement to Session Manager A 31. 

15 After receiving the acknowledgement that the 

destination money module has been contacted (Step 198) , 
the Maintain Security application A will send its 
certificate to the Maintain Security application B through 
each application's respective Session Manager (Steps 200- 

20 206 >- 

Xt is anticipated that the money modules will 
exchange certificates to verify that each money module is 
interacting with another valid money module. To this end 
(as seen in Fig. 3 4 A) , the Public Key application B 44 
25 tests the certificate of money module A by using the 

public key algorithm and the public key corresponding to 
the private key used by money module A, to encrypt and 
check A's certificate and verify that it is valid (Step 
208) . 

30 If the certificate is found invalid, the session 

Manager B will note the session is terminated (Step 210) . 
In the case of a Transaction money module 4, the To 
Subscriber B informs the subscriber of the transaction 
termination (Setup 212) . Likewise, a Teller money module 

35 5 of Money Generator Module 6, uses the To Bank 
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o application B 47 to notify the bank of the termination. 
Step 213. It is anticipated that the counterparty money 
module will then timeout to end the exchange. 

In Step 214, Fig. 34A, assuming that the 
certificate of money module A is valid, the Maintain 
5 Security application B 37 checks to see if Transaction 
money module A is on the list of compromised money modules 
(Step 215) . If money module A is on that list, the 
process flow returns to step 210 so that the 
communications can be terminated. 
10 Alternatively, when money module A is not on the 

list of compromised money modules, then Random Number 
Generator B 46 creates a session key (Step 216) and 
encodes the session key along with money module B's 
certificate and a verification message, using money module 
15 A's public key (Step 218). This encoded message is sent 
to money module A by Session Manager B 31 (Step 220) . 

Session Manager A 31 receives the message from 
money module B (Step 222), and uses its Public Key 44 
algorithms application to decode the message (Step 224, 
2Q Fig. 34B) , and to verify money module B's certificate 
(Step 226). 

If the test determines that money module B's 
certificate is invalid, the operation branches to an 
"abort transaction" procedure to terminate the steps taken 
25 thus far in establishing a session (Steps 500-524). This 
procedure may be used, for example, to end the 
communication session and to functionally shut off money 
module A, which results in the communication link ending. 
(Steps 500-524,, Figure 32). 

30 

Abort Transaction 



Branching to Figure 32, the functional shut-off 
of a money module through the abort transaction process 
will now be described in detail. It will be understood 
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that the following process may be used when any two money 
modules are abnormally terminating the transactions 
occurring between them. Accordingly, the money modules 
will be designated "X" and *Y n to illustrate the generic 
applicability of the process steps. 

An abort transaction process initiated by money, 
module X to terminate communications with money module Y 
begins with Session Manager X 31 capturing and then 
reversing or rolling back any programmatic changes that 
were made to the money module (Step 500) , and then noting 
that the session has been aborted (Step 502) . 

In the case where the money module that is 
initiating the termination is a Transaction money module 
4, the To Subscriber application 33 informs the subscriber 
of the communication termination (Step 510). likewise, a 
Teller money module 5 informs its To Bank application 47 
of the termination so that any accounting changes may be 
undone (Step 508) . Next, the Session Manager X 31 of the 
terminating money module sends an encoded message to the 
other money module involved (Step 512). 

Briefly referring to Figure 37, all encrypted 
messages between modules will be provided by the following 
steps. The sending money module (here also referred to as 
"X") uses its Symmetric Key 45 to encode the message to be . 
sent to the receiving money module (here also referred to 
as "Y"). (Step 2). Again, it will be appreciated that 
there are a number of known encryption techniques which 
may be utilized. 

The Session Manager X 31 sends the encoded 
message to session Manger Y 31 which in turn decodes the 
message using its Symmetric Key Y 45 (Steps 4-8) . 

Continuing with Figure 32, the Session Manger Y 
responds to the termination notice sent by also undoing 
any changes it may have made towards establishing the 
session, and noting the aborted session (Steps 514-516) . 
If it is a Transaction money module 4 that is now shutting 
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u down, the To Subscriber application 33 alerts the 
subscriber of the condition (Step 518 & 524) . 
Correspondingly, in a Teller money nodule 5, the To Bank 
application 47 will reverse all accounting transactions 
that have been undertaken (Steps 518-522) . 
5 Returning to Figure 34B, assuming that the money 

module B certificate is valid, in Step 228 Maintain 
Security A checks to see if money module B is on the list 
of compromised money modules. If money module B is on the 
list (Step 230) , the session reverts to the abort 
10 transaction procedure, Steps 500-524. Thereafter, the 
communications session is dissolved. 

More typically, money module B will not be on 
the list of compromised money modules, and the Clock/Timer 
A 43 will retrieve the date and time (Step 232) and send 

15 this information to the Maintain Security application A 37 
so that the verification message may be assembled with the 
date and time (Step 234). 

Symmetric Key A 45 then encrypts the 
verification message with the date and time information, 

2o using the random session key provided by money module B 
(Step 236). Session Manager A 31 sends this encrypted 
message (Step 238) to Session Manager B 31 (Step 240) . 
From there, the Symmetric Key application B 45 decrypts 
the message (Step 242) and passes it to the Maintain 

25 Security B 37 for message verification (Step 244, Fig. 
34C) . An incorrect message will cause the session to be 
aborted through Steps 500-524, while a correct message 
will advance the procedure so that Maintain Security B 37 
can compare the time and date with that of money module A 

30 (Step 248). 

Clock/Timer B 43 will verify that money module 
A's clock is within a preset amount of deviation from the 
clock of money module B (Step 250) . If the discrepancy 
between the two clocks is greater than a predetermined 

35 amount, the session will be aborted by branching to Steps 
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, 500-524. 

If there is no discrepancy that is greater than 
the permissible amount. Session Manager B 31 will note its 
start of a session (Step 252) , and send an acknowledgement 
to money module A to start the transaction (Step 254) . 
After the encoded message is sent from money module B to 
Session Manager A 31 using process steps 2-8, Fig. 37, 
Session Manager A 31 acknowledges the message receipt and 
also notes the start of session (Steps 256-258) . 

Request Withdrawal 

After a session is established between the 
Transaction money module 4 and Teller money module 5, the 
Transaction money module 4 makes a withdrawal request 
from the Teller money module 5. See Figure 29. Referring 
now to Figure 30, a process for requesting a withdrawal 
will now be described. It should be noted that although 
the figure denotes the parties as "X" and n ¥, " in the 
process steps describe below, they are applicable to any 
money module transacting with a Teller money module 5. 

To begin, the To Teller X 34 sends a withdrawal 
request to the Teller money module 5 r requesting a certain 
amount of money to be withdrawn from a specific account. 
In its transmission of the withdrawal request, the account 
number and the account profile will be transmitted from 
the requesting money module to the Teller money module 5 
(Step 700) . To send this request, the process Steps 2-8 
are repeated, in which the message is encrypted using the 
previously described cryptographic techniques. 

Validate Account Number 



35 



Once the withdrawal request and the account 
number and profile are transmitted to the Teller money 
module 5, a procedure to validate the account number is 
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- initiated (Steps 7041-7055) . A flow diagram depicting how 
an account number is validated is shown in Figure 38. 

In this process, the Maintain Security 
application 37 of the Teller money module 5 receives the 
account profile and signature and conveys them to its 
5 Public Key application 44 to verify the profile signature 
(Steps 7041-7042) . The signature is tested using the 
public key generated and distributed by the Bank's 
Security Server 27. An invalid signature causes the 
Maintain Security 37 application to inform the Session 
10 Manager that the account profile is invalid (Step 7044) , 
whereby Steps 500-524, Fig. 32, are followed to abort the 
transaction between the two money modules. 

If the signature test confirms a valid 
signature, the procedure advances to the To Bank 
application 47 which sends the account number it has 
received on to the bank's computer systems (Step 7046). 
An inactive account will cause the Maintain Security 
application 37 to inform the Session Manager of the 
inactive account (Step 7048) and have the transaction 
2q aborted following steps 500-524 ; an account that has not 
been inactive will allow the Maintain Security application 
37 to check if "the account profile needs to be recertified 
(Steps 7047-7050). 

If the account profile does need to be 
25 recertified, the Maintain security application 37 will to 
send the account profile to the Security Server 27 (Fig. 
38A, Steps 7051-7052) , when will recertify the account 
profile and send it on to the Teller money module 5 (Step 

7053) . In response, the Teller money module 5 sends it to 
3 0 the money module making the withdrawal request (Step 

7054) . 

The communication from the Teller money module 5 
to the money module utilizes the previously described 
routine for sending messages. Steps 2-8. The Maintain 
3 5 security application 37 then updates the account profile 
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» in the money module and returns an acknowledgement to the 
Maintain Security application 37 in the Teller money 
module 5 (Step 7055) , also using Steps 2-8. The 
electronic message is received by the Maintain Security 
application 37 of the Teller money module 5, and 
5 acknowledged in Step 7056. 

With the account information checked, the 
process returns to Step 704 of Figure 30. The To Bank 
application 47 now verifies that there are sufficient 
funds to support the withdrawal request (Step 704) . 

10 sufficient funds will prompt the return of an 

acknowledgement to a Transaction money module 4, utilizing 
process Steps 2-8 to transmit the acknowledgement to its 
To Teller 34 application function (Steps 706-714) . In the 
case of a Teller money module 5, no acknowledgement is 

15 required. . 

In the case of a Transaction money module 4, an 
insufficient amount of funds will cause the subscriber to 
be prompted to enter a new amount for the withdrawal 
(Steps 718-720, Figure 30A) . As shown by Step 724, the 

20 newly entered amount causes the To Teller application 34 
to send the new request to the To Bank application 47 
(using Steps 2-8) of the Teller money module 5 to verify 
if there are sufficient funds to cover the latest 
requested amount, returning to Step 704 of Fig. 30. If 

25 the new request is still greater than the funds on balance 
at the bank, the Teller money module 5 will initiate Steps 
500-524 to abort the transaction between the to money 
modules. In the case of a Teller money module 5, the 
transaction is allowed to overdraw the account. 



30 



Transfer Notes 



35 



Referring back to Figure 29, To Teller A 34 
transfers the total of its currency notes 11 to the Teller 
money module 5 (Step 45) . If there are no notes 11 being 
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« held in the Transaction money module 4 at the time the 
withdrawal request is made, the To Teller A application 34 
sends a message to the Teller money module 5 that there 
are no notes 11 present (Step 47) , using process Steps 2- 
8. 

5 Electronic notes 11 are transferred between 

money modules using the procedure described below 
(referring now to Figure 39) - The Mote Directory 
application 39 of the transfer or money module chooses the 
notes 11 of proper values for the transfer (Step 750) , and 

10 has the Notes application 40 create a transfer for each 
note 11 (Step 752). The Public Key application 44 creates 
signatures for all the notes 11 (Step 754) and sends the 
notes 11 to the Packet Manager application 41, for 
assembling the note 11 transfers and signatures into a 

15 packet to be sent to the requesting money module (Step 
756) . 

steps 2-8 are utilized to transfer the packet of 
electronic notes 11 to the Packet Manager application 41 
of the requesting money module for receipt and disassembly 

2 q (Step 758) . The Verifier application 42 verifies the 

transfers appended to the certificates, and verifies that 
the total amount conforms to the notes 11 that should be 
sent (Step 760) . 

Any invalid information will cause the 

25 transaction between the two money modules to be aborted, 
using the procedure outlined in Steps 500-524 above (Step 
761) . Valid notes 11 will have their expiration dates 
checked (Step 762) by the Verifier application 42 when it 
is a Transaction money module 4 that has conveyed the 

30 notes 11 (Step 763). Any expired notes 11 (Step 764) will 
cause the sessions to be aborted using the procedures 
outlined in Steps 500-524, Fig. 32. 

Assuming the notes 11 have not expired, or in 
the case where a Teller money module 5 is accepting them, 

35 the process flow resumes at Step 765, Fig. 39A. In this 
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„ Step, the Public Key Y application 44 verifies the digital 

signatures. Invalid signatures invoke the transaction 

abort process of Steps 500-524. 

Valid electronic notes 11 are then sent to the 

Notes application 40 (Step 768) and the Note Directory 39 
5 is updated with the new note locations and amount (Step 

770) . 

Returning to Figure 28, the To Transaction B 49 
checks if the electronic notes 11 have been transferred 
(Step 772) , and if notes 11 have indeed been transferred 
from a Transaction money module 4, accounting transactions 
are posted to reflect this situation (Step 776; see also 
Fig. 14, step 1) by the To Bank application B 47. Both in 
the case when no notes 11 have been transferred from the 
money module, and after the later accounting transactions 
^ are posted in Step 776, a session is established between 
the Teller money module 5 and the Money Generator module 6 
using the procedure outlined above in Steps 190-258, Figs. 
34, 34A-C. 

As notes 11 are requested to satisfy the 
withdrawal, an account posting occurs to reflect the 
request. The To Bank application B 47 will post the 
proper accounting transactions (Step 778, Fig. 28) as also 
illustrated in Figure 14, Step 2. 

25 ReqUeSt MOteS 

Directing attention to Figure 40, notes 11 may 
be requested between Teller money modules 5 and Money 
Generator modules 6 using the following procedure 
described below. 

30 

The To Money Generator application 48 of the 
requesting Teller money module 5 will issue a request for 
a specific amount of electronic money to be created (Step 
780) . The request will be sent using the above described 
Steps 2-8 for encrypted transmission, to the To Teller 
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„ application 34 of the Money Generator module 6 so that the 
Honey Creator application 50 may be activated (Step 784) 



are signed by the Public Key application 44 of the Money 
Generator nodule 6 (Step 788) and placed in a holder by 
its Notes application 40 (Step 790) . Finally, the Note 
Directory 39 is updated with the information about the 
newly created electronic notes 11 (Step 792) . 

The process flow now returns to the procedures 
shown in Figure 28. The requested notes in the Money 
Generator module 6 are transferred to the Teller money 
module B 5 using the process Steps 750-770 outlined above 
for transferring electronic notes 11. The notes 11 are 
then transferred from the Teller money module B 5 to the 
Transaction money module 4 using these same process Steps 
750-770 for transferring electronic notes 11. 

Finally, to successfully complete the withdrawal 
of electronic notes 11, the money modules will "commit" to 
or finalize the transaction by utilizing the following 
procedure. Referring now to Figure 41 for a detailed 
description of this process, the Tran Log Mgr. application 
36 updates its Tran Log to record the transaction that has 
occurred above (S^ep 690) . When it is a Transaction money 
module 4 that is committing to the exchange (Step 691) , 
the To Subscriber application will notify the subscriber 
that the transaction has been successfully completed (Step 
692) . Of course, the Session Manager application A 31 
will note the end of session (Step 693) , and employ 
process Steps 2-8 to send the message to the money module 
it is transacting with. 

With this end of session notice received, the 
other money module, in this example a Teller money module 
5, will use its Tran Log Mgr. application 36 to update its 
own Tran Log (Step 694). Assuming, however, the second 
money module receiving the end of session notice is not a 



to create the electronic notes 11 (Step 786) . 

After the creation of electronic notes 11, they 
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„ Teller money module 5, an additional step of having the To 
Subscriber application 33 notify the subscriber of the end 
of the transaction occurrence (Step 696) will be 
necessary. Thereafter, the Session Manager 31 of the 
second money module in both cases will also make note of 

5 the end of the session (Step 698) . 

Directing attention back to Figure 28, the 
process to commit is initiated first by the Transaction 
money module 4 committing its transaction with the Teller 
money module B 5 (Steps 690-698) . The process steps are 

Q also applied to commit the transaction between Teller 
money module B 5 and the Money Generator module fi (Steps 
690-698) - That completes the processing for one complete 
withdrawal of electronic money from an Issuing Bank X. 



Withdrawal From A Correspondent Bank 

A withdrawal from a Correspondent Bank 2 will 
now be described, aided by reference to Figure 35. To 
begin, the previously described Steps 43-48 to set up a 
withdrawal are undertaken by a Transaction money module A 
4, in conjunction with an Teller money module B 5. Next, 
Steps 190-258, used to establish a session, also described 
above, are initiated between Teller money module B 5 and 
Teller money module C 5. After the sessions have been 
established, the To Bank application B 47 will post the 
accounting transaction corresponding to the withdrawal 
that is going to subsequently occur (Step 900; see also 
Fig. 13, Step 1). 

As previously noted, it is contemplated that 
whenever a Transaction money module 4 interacts with a 
bank, both Issuing 1 and Correspondent 2, all electronic 
notes IX that are stored within the Transaction money 
module 4 are removed and replaced with electronic notes XI 
containing the most recent certificate. To perform this 
operation. To Transaction B 49 will check to see if there 
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o are notes 11 stored within the Transaction money module 4 
(Steps 902-904). If there are notes 11, To Bank B 47 will 
post the appropriate accounting transactions (see 
accounting procedure illustrated in Figure 13; Step 2) 
(Step 906) , and perform a deposit request from the Teller 
5 money module C 5 (associated with an Issuing Bank 1) to . 
return the notes 11 that need to be replaced. 

For a detailed description for performing a 
deposit request, attention will be directed to Figure 44. 
Here, the To Teller application 34 sends a deposit request 

1Q message, the amount of the deposit to be sent, the account 
number and the account profile of the account to which the 
notes 11 will be deposited (Step 920) . This information 
is transferred to the Teller money module 5 using Steps 2- 
8 for sending messages, and then Steps 7041-7050 (see 

15 Figure 38) are performed to validate the account profile 
and number. 

In the case where the depositor is a Transaction 
money module 4, the To Transaction application 49 of the 
Teller money module 5 will send an acknowledgement to the 

2Q Transaction money module 4 that the transfer of notes 11 
is ready to proceed (Step 924) . Alternatively, if it is 
another Teller money module 5 that is making the deposit, 
it is the To Teller application 34 that issues the 
acknowledgement to the Teller money module 5 (Step 926) . 

25 In either case, the acknowledgement is encrypted 

and transmitted using the procedure outlined in Steps 2-8, 
whereby it is received by a To Teller application 34 of a 
depositing money module (Step 928) . 

Referring back to Figure 35, once the deposit 

3Q request is completed, the notes 11 are transferred from 
the Teller money module B 5 to the Teller money module C 5 
using Steps 750-770, Figs. 39, 39A detailed above for 
transferring notes. Accordingly, To Bank C 47 posts the 
proper accounting transactions (see Figure 13, Step 2) to 

35 reflect this transfer of notes 11 (Step 908) . In Teller 
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o money module C 5, the To Teller application 34 
acknowledges the deposit by sending a message back to the 
To Teller 8 34 application (Steps 910-912) , using Steps 2- 
8. Naturally, the To Bank B 47 will now post its 
accounting transactions to reflect the withdrawal request 

5 it has made to Teller money module c 5 (Step 914; see also 
Fig. 13, Step 3) . 

After all electronic notes 11 have been removed 
from the Transaction money module 4 and the proper 
accounts have been posted, a withdrawal is requested of a 

q total amount that includes both the amount originally 
requested to be withdrawn from the subscriber's bank 
account and the amount that was removed from the 
Transaction money module 4 to be replaced with updated 
electronic notes 11. 



Teller money module B 5 and Teller money module C S using 
the process Steps 700-724, Figs. 30, 30A, described above. 
Teller money module C 5 transacts with Honey Generator 
module 6 to withdraw new electronic money and in doing so 
it establishes a session between the two modules using the 
process Steps 190-258, Figs. 34, 34A-C. 



Teller money module C 5 from the Money Generator module 6 
using process Steps 780-792, Fig. 40, and the notes 11 are 
transferred from the Honey Generator module 6 to the 
Teller money module C 5 using the Steps 750-770, Figs. 39, 
39A. 



accounting postings (Step 916; see also Fig. 13, Step 4). 
After this, the electronic notes 11 are transferred from 
Teller money module C 5 to Teller money module B 5 using 
the Steps 750-770? the notes ll are than transferred to 
Transaction money module A 4 also using Steps 750-770. 

To finalize the withdrawal from the 
Correspondent Bank 2, each money module must commit to the 



15 



The withdrawal request is performed between 



The electronic notes 11 are requested by the 



The To Bank application c 47 performs the 
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o transaction it has just had with the corresponding money 
module. Thus, Transaction money module A 4 commits to 
Teller money module B 5 using Steps 690-698, Fig. 41, and 
thereafter Teller money module B 5 commits to Teller money 
module C 5. Finally, Teller money module C 5 commits to 

5 the Money Generator module 6, using the same process Steps 
690-698. 

Deposit To An Issuing Bank 

L0 Referring to Figure 42 in combination with 

Figure 43, an example of a deposit to an Issuing Bank 1 
will now be described in detail. To start the 
transaction, a deposit set up must be done which uses the 
process steps shown in Figure 43. 

5 In Step 398 at the top of Figure 43, the 

subscriber decides to deposit some money to a bank. After 
performing the sign-on routine for a Transaction money 
module 4 (following Steps 10-42, Figs. 31-31A) , the To 
Subscriber A 33 prompts the subscriber for the transaction 

Q desired (Step 400) . 

In this example, the subscriber chooses the 
deposit transaction, the amount to be deposited, and the 
bank and account number in which to deposit the electronic 
money (Step 402) . Before any other procedures. Note 

5 Directory A 39 checks to see if the money module contains 
funds sufficient to support the deposit request (Step 
404). 

Assuming there are insufficient funds for the 
deposit, To Subscriber A 33 prompts the subscriber for a 

Q new amount (Step 410) and if no new amount is selected, 
the Session Manager A 31 informs the subscriber that the 
transaction must be terminated (Step 414) . If the 
subscriber enters a new amount, Step 412, the process flow 
returns to step 404, wherein the Note Directory 39 

5 application again checks for sufficient funds for the 
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u -transaction. 

Assuming there are adequate funds within the 

money module, the process flow advances to the Network 25 

sign-on procedures outline in Steps 50-168, Figs. 33-33A. 

A successful Network 25 sign-on then advances the process 
5 flow to Steps 190-258, for establishing a session between. 

the Transaction money module A 4 and Teller money module B 

5. 

Once the session is established between the two 
money modules, the deposit request steps outlined in 

^ o procedures 920-928 are followed conveying the request from 
Transaction money module A 4 to the Teller money module B 
5. The To Teller A 34 transfers all of the electronic 
notes 11 stored within the money module to the Teller 
money module B 5 (Step 408) using the Steps 750-770 

15 described above for transferring electronic notes ll 
between two money modules. 

Continuing with Figure 42, the To Bank B 47 
posts the accounting transactions for the notes deposited 
(Step 418, see Fig. 12 Step 1). In Teller money module B 
5, the To Transaction application 49 checks to see if the 
amount deposited is less than the total notes 11 that were 
stored in module A and then transferred to the Teller 
money module 5 (Step 420} . If the deposit is less than 
the total amount of transferred notes 11, updated notes 11 

25 must be generated and sent back to the Transaction money 
module 4. 

When all the notes that are contained in the 
Transaction money module 4 are deposited, i.e., the amount 
to be deposited is not less than the total amount of 
electronic notes 11, the To Transaction B 49 will send an 

30 

acknowledgement to the Transaction money module 4 (Step 
428) using the Steps 2-8 for sending messages between 
money modules. The To Teller A 34 receives the 
acknowledgement (Step 430) and initiates the Steps 690-698 
to commit the deposit transaction between the two money 
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„ modules. 

When the electronic notes 11 removed exceed the 
desired deposit amount, new updated notes 11 must be 
returned to the Transaction money module 4. To perform 
this, the To Bank application B 47 of the Teller money 
5 module B 5 posts the proper accounting transactions (Step. 
424; Fig. 12, Step 2). Thereafter, Teller money module B 
5 establishes a session with the Money Generator module 6 
using process Steps 190-258, and requests electronic notes 
11 from the Money Generator module 6 in the amount that 

1Q should be returned to the Transaction money module 4, by 
performing Steps 780-792. 

The electronic notes 11 are created by the Money 
Generator module 6 and transferred to the Teller money 
module B S using Steps 750-770. With the electronic notes 

15 11 in the possession of the Teller money module B 5, they 
are transferred to the Transaction money module A 4 using 
Steps 750-770. 

After Transaction money module A 4 receives the 
electronic notes 11, it must finalize the transaction by 

2Q committing Teller money module B 5 to Transaction money 
module A 4 using Steps 690-698. Likewise, Teller money 
module B 5 must commit to the Money Generator module 6 
using the same Steps 690-698. 

2 5 Deposit To A Correspondent Bank 

Figure 45 illustrates the process flow for a 
deposit at a correspondent Bank. In depositing to a 
Correspondent Bank 2 , the deposit set up described in 
3Q Steps 398 through 414 are repeated in the first stage of 
the transaction. From there the To Transaction B 49 tests 
to see if the deposit is less than the total amount of 
electronic notes 11 that have been withdrawn in the 
deposit set up procedures that were just processed (Step 

„ 440). 
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In the case where all the electronic notes XI 
stored in the Transaction money module 4 are equal to the 
amount of notes 11 to be deposited, then To Transaction B 
49 sends a deposit acknowledgement back to the Transaction 
money module 4 (Step 444), using Steps 2-8 to send the 
5 message from the Teller money module B 5 to Transaction • 
money module A 4. 

On the Transaction money module 4 side, the To 
Teller 34 application receives the acknowledgement (Step 
446) and uses Steps 690-696 to commit the transaction with 
10 Teller money module B 5- The Transaction money module 4 
is now finished and removed from the process. The 
final ization of the deposit provides for the account 
posting transactions to be made by the To Bank application 
47 (Step 448). See Figure 11, Step l for the accounting 
15 transactions. 

A sessions is now established between the Teller 
money module B S and Teller money module C 5 using Steps 
190-258. 

Teller money module B 5 issues a request to make 
20 a deposit to the Teller money module C 5 by using process 
Steps 780-792. The To Bank B 47 then posts the accounting 
transactions (Step 450; see also Fig. 11, Step 2). 

Notes 11 are now transferred from the 
correspondent Bank B 2 to the Issuing Bank C 1 using Steps 
25 750-770; the Issuing Bank C 1 posts the corresponding 

accounting transactions (Step 452; see also Fig. 11, Step 
2) . The To Teller C 34 responds by sending the deposit 
acknowledgement (Step 454) using Steps 2-8, to To Teller 
application 34 of Teller money module B 5 (Fig. 45A, Step 
30 456). 

Here again, the deposit is checked to see if it 
is less than the amount of electronic notes 11 that have 
been removed earlier, and when it is not, the withdrawal 
is completed with the process Steps 690-698, Fig. 41, to 
35 commit Teller money module B 5 to Teller money module C 5. 
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A deposit: request that is less than the amount 
of notes ll that are withdrawn requires account updating 
(Step 460; see also Pig. 11, step 3), and new notes 11 to 
replace the additional notes ll that were taken. 
Accordingly, a withdrawal request following the process 
5 Steps of 920-928 from Teller money module B 5 to Teller • 
money module C 5 is made to provide these new electronic 
notes 11. 

Teller money module C 5 must first establish a 
session with the Money Generator module 6, using the 
10 process Steps 190-258. The new electronic notes 11 are 
requested by the Teller money module C S from the Money 
Generator module 6 following process Steps 780-792, which 
are then transferred to the Teller money module C 5 using 
Steps 750-770 to transfer notes ll between money modules. 
15 This transfer of electronic notes 11 to the 

Teller money module C 5 requires that accounting 
transactions be posted by the To Bank application C 47 
(Step 462, Fig. 45B; see also Fig. 11, step 3). 

From there, the notes ll are transferred from 

20 the Issuing Bank's l Teller money module C 5 to the 

Correspondent Bank's 2 Teller money module B 5 and to the 
Transaction money module 4 by using steps 750-770 for 
transferring notes 11. Thereafter, each money module must 
commit to the money module with which it has established a 

25 session. Thus, Transaction money module A 4 commits to 
Teller money module B 5, Teller money module B 5 
subsequently commits to Teller money module C 5, which 
then commits to the Money Generator module 6. All three 
of these commitment transactions use process Steps 690-698 

30 above. 

Subscriber To Subscriber Payment 

Figure 36 illustrates the process flow for a 
35 payment transaction from one Transaction money module 4 to 
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° another. In this example of a preferred embodiment, Alice 
(or a hypothetical payor corporation, is denoted "A" in 
Figure 36) will agree to pay Bob (or a hypothetical payee 
corporation, is denoted "B" in Figure 36) a specific 
amount of electronic money (Step 800) . Both Alice and 
5 Bob sign on to their respective Transaction money modules 
4 using the process Steps 10-42 described above. Through 
the To Subscriber A 33 application, Alice directs her 
Transaction money module 4 to make a payment (Step 806 & 
810) , while Bob operates his Transaction money module 4 

10 such that the To Subscriber B 33 application will issue an 
entitlement to receive payment (Step 808 & 812) . 

In Steps 814 & 816 the Session Managers 31 of 
both Alice's Transaction money module 4 and Bob's 
Transaction money module 4 established communications. 

15 From there a session is established, as described in Steps 
190-258 above for transacting between any two money 
modules. 

With a session established. To Subscriber A 33 
prompts the subscriber to enter the amount of payment that 

20 she desires to transfer (Step 818) , which is displayed to 
the subscriber. 

Alice enters the amount that she wishes to 
transfer to Bob. Pay/Exchange application A 35 receives 
the amount entered (Fig. 36, Step 820) . The amount 

25 entered by type (currency or credit) is now compared by 
Note Directory A 39 to the balance of the value of the 
electronic money stored in the Transaction money module 4, 
to see if there are sufficient funds available to permit 
the transaction to proceed (Step 822) . 

30 If there are insufficient funds. To Subscriber A 

33 sends the subscriber a notice that there are not 
sufficient funds to cover the transaction desired (Steps 
824-826), and prompts the subscriber again for a new 
amount of payment (Step 827) . If the subscriber prefers 

35 not to enter a new amount, the abort transaction process 
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> Steps 500-524 are activated to terminate the 
communications link between the two Transaction money 
modules 4. On the other hand, a newly entered amount will 
return the process to Step 820, to check for sufficient 
funds again. 

■ When there are sufficient funds stored in 

Transaction money module A 4 to process the transfer, 
Pay/Exchange A 35 sends a message disclosing the amount of 
the transfer to Bob's Transaction money module 4 (Step 
828), using the process disclosed in Steps 2-8. See Fig. 

, 36A. From there, To Subscriber B 33 prompts the owner to 
verify that the amount to be transferred will be accepted 
by him (Step 830) . Bob can then decide whether to accept 
or reject the amount to be transferred (Step 832) . 

If Bob responds in the negative, then 
Pay/Exchange B 35 will send a message back to Transaction 
money module A 4 using Steps 2-8, that the amount to be 
transferred is incorrect (Step 834) ; the process again 
returns to Step 826, Fig. 36, to prompt Alice for a new 
amount to be entered. 

When Bob responds in the affirmative in step 
832, Pay/ Exchange B 35 will send an acknowledgement to 
Transaction money module A 4 using Steps 2-8 (Step 835) . 
Back in Transaction money module A 4, the message will be 
conveyed to Pay/Exchange A 35 to receive the 
acknowledgment sent by Transaction money module B 4 (Step 
836) . 

With this acknowledgement received, Pay/Exchange 
A 35 will send the amount desired to be transferred to the 
Money Holder 38 (Step 838) so that the electronic notes 11 
may be transferred using Steps 750-770. With the transfer 
completed, the two Transaction money modules 4 must commit 
to the transfer using Step 690-698 described above. The 
communication link between the two transaction modules may 
now be terminated. 



35 
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Subscriber to Subscriber Foreign Exchange 

Referring to Figure 46, the process flow for an 
exchange of foreign currencies between two Transaction 
money modules 4 will now be illustrated. In this example 
5 Alice (or a hypothetical corporation, denoted "A" in 

Figures 46-46A) agrees to exchange dollars for pounds with 
Bob (or a hypothetical corporation, denoted "B" in Figures 
46-46A). The exchange rate that they have agreed to will, 
be a ratio of dollars to pounds (Step 300) . 

1Q Alice begins by signing on to her Transaction 

money module 4 (using Steps 10-42 described above) while 
Bob signs on to his Transaction money module 4 (using 
Steps 10-42) . Thereafter, the To Subscriber 33 
applications of both Transaction money modules 4 prompt 

2^ the respective users to select a type of transaction 

(Steps 302-303) . In this example, Alice and Bob agree to 
exchange her dollars for his pounds. 

By requesting the foreign exchange transaction, 
Session Manager A 31 will establish a communications link 

2Q with Session Manager B 31 (Steps 306, 307) so that a 

session may be established between the two money modules 
using Steps 190-258. Alice is then prompted by To 
Subscriber A 33 for the amount of dollars she will sell, 
and the exchange rate that she will use in the transaction 

25 (Step 308) . 

Pay/Exchange A 35 receives the input (Step 310) 
and Note Directory A 39 checks for sufficient funds by 
comparing the amount requested to the amount of value 
contained in the Transaction money module 4 (Step 312) . 

3Q An insufficient funds condition will cause the To 

Subscriber A 33 to send an insufficient funds message to 
Alice and prompt the subscriber to select another amount 
of dollars and exchange rate (Steps 318-320) . When new 
selections are entered, the process flow returns to Step 

35 312 and continues from there. If Alice does not select a 
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o new amount, the session is dissolved using abort 
transaction steps 500-524. 

When the funds are sufficient to meet the amount 
requested, the Pay/Exchange A 35 sends the amount of the 
dollars and the proposed dollar/pound exchange rate (Step 
5 316) to the To Subscriber application 33 of Transaction . 
money module B 4 using the Steps 2-8. (See Figure 46A) . 
At this point. To Subscriber B 33 prompts Bob with the 
amount and rate proposed by Alice, to determine if the 
values are what Bob will agree to exchange (Step 322) . 
10 The Pay/Exchange B 35 receives the dollar amount 

and the rate that is proposed by Alice and if the amount 
and rate are not agreed to by Bob, Pay/Exchange B 35 will 
send a message indicating that the value or exchange rate 
is incorrect (Step 326) , through the Steps of 2-8 for 
15 sending messages. To Subscriber A 33 prompts Alice for 
the dollar amount and exchange rate over again (Step 327). 
Entry of new values returns the process to Step 310 for 
continuation, see Fig. 46, while the lack of new values 
entered causes the abort transaction process of Steps 500- 
2Q 524 to be initiated. 

If the amount and rate are agreed to by Bob, 
Pay/Exchange B 35 will calculate the equivalent amount in 
pounds, based on the rate provided (not shown) , and then 
initiate the step of having Note Directory B 39 check to 
25 see that Transaction money module B 4 contains sufficient 
funds to fulfill the exchange (Step 323). When the funds 
in Transaction money module B 4 are insufficient to meet 
the exchange, Pay/Exchange B 35 sends a message to Alice 
of insufficient funds (Step 325) using Steps 2-8. The 
30 process flow returns to Step 327. 

Proceeding with the case in which sufficient 
funds do exist in Transaction money module B 4, 
Pay/Exchange B 35 will send an acknowledgement using Steps 
2-8 to Transaction money module A 4 (Step 329) . After 
35 receiving this acknowledgement, Pay/Exchange A 35 sends 
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-the amount, of dollars requested to its corresponding Honey 
Holder 38 application in Step 330. The dollars are 
transferred from Alice to Bob via the Steps 750-770 
described above for transferring notes XX. 

Pay/Exchange B 35 receives the notes XX and then 
5 -transfers the amount of pounds to its Honey Holder 38 

application (Step 331) . From there, the electronic pounds _ 
are transferred to Alice using the transfer notes process 
described in Steps 750-770. To record this exchange, 
Transaction money module A 4 commits with Transaction 
10 money module B 4 by using process Steps 690-698 described 
above. With a satisfactory exchange, the communications 
link between the two Transaction money modules may now be 
terminated. 

!5 Foreign Exchange At An Issuing Bank 

Turning attention now to Figure 48, if a 
subscriber were to exchange his/her dollars for pounds 
with an Issuing Bank X instead of with a subscriber, the 

20 following process is followed. 

Subscriber A sets up the foreign exchange 
transaction by signing on to his/her Transaction money 
module 4 (see Fig. 47Z) using Steps 10-42 described above. 
To Subscriber A 33 prompts the subscriber for the 

25 transaction desired (Step 334) , and in this example, the 
subscriber chooses the dollar/pound exchange, and the 
amount of dollars the subscriber will exchange. It is 
anticipated that the choice of the bank to transact with 
may be an option offered to the subscriber (Step 336) . 

30 The Note Directory A 39 checks for a sufficient 

balance to complete the request (Step 338) . An 
insufficient balance permits the subscriber to again enter 
the amount he/she will exchange (Step 340-342) , whereby 
Session Hanager A 3X will terminate the transaction (Step 

35 345) if no new amount is entered. Entry of a new amount 
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returns the process to Step 338 to check for sufficient 
funds to meet the new request. When the funds are 
sufficient for the exchange request, a Network 25 sign-on 
using Steps 50-168 is commenced. 

After the Network 25 sign-on, the Network 25 
5 checks if a bank or financial institution has been 

selected (Step 346) . If a bank or financial institution 
was not chosen earlier, To Teller A 34 must prompt the 
Network Server 26, through Session Manager A 3X, for a 
list of banks or financial institutions that will provide . 
10 the exchange (Steps 348-350) . The Network Server 26 sends 
the list (along with rates) to the subscriber through the 
To Teller A 34 and To Subscriber A 33 applications (Steps 
352-356) . 

After prompting (Step 357, Fig. 47A) , the 
15 subscriber chooses a bank or financial institution, or 

ends the transaction (Step 359) . When a bank or financial 
institution is chosen, a session is established with the 
Teller money module 5 chosen using Steps 190-258 described 
above. After a session is established, To Teller A 34 
20 sends the amount of dollars to be exchanged for pounds 

(Step 360) using Steps 2-8 for encrypting and transmitting 
a message. 

To ensure that the subscriber still wants to 
proceed with the exchange, To Transaction B 49 sends the 

25 current exchange rate to the subscriber using process 
Steps 2-8 (Step 362) . At this point. To Subscriber A 33 
prompts the subscriber with the bank's exchange rate and 
if the subscriber does not wish to proceed, the 
transaction is aborted by following Steps 500-524 (steps 

30 364-366) . If the transaction is to proceed, the dollars 
are transferred from Transaction money module A 4 to 
Teller money module B 5 using Steps 750-770 described 
herein. 

Returning to Figure 48, once the set up of the 
35 foreign exchange transaction is accomplished, the proper 
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accounting transactions are posted (Step 368; also 
illustrated in Figure 15, step 1) to reflect the dollars 
that have just been transferred. A session is established 
between Teller money nodule B 5 and a Money Generator 
module 6 via Steps 190-258. Teller money module B 5 
5 requests the proper pound notes II through process Steps 
780-792. The notes 11 are returned from the Money 
Generator module 6 to the Teller money module B 5 using 
Steps 750-770. 

This latter transfer of notes 11 requires a 

10 corresponding updating of the accounts involved (Step 370; 
see also Fig. 15, Step 2). The notes 11 are transferred 
to the Transaction money module A 4 through process Steps 
750-770. To complete the exchange, Transaction money 
module A 4 commits to Teller money module B 5 who 

15 subsequently commits to the Money Generator module 6 using 
process Steps 690-698. 

Foreign Exchange At A Correspondent Bank 

20 The foreign exchange with a Correspondent Bank 2 

is described with the aid of Figure 49. Initially, the 
foreign exchange transaction is set up by repeating 
process Steps 334-366, (Figs. 47-4 7A) and updating the 
proper accounts (see Figure 16, Steps 1-2) to reflect the 

25 notes 11 that have just been transferred from the 

subscriber's money module 4 to Teller money module B 5 
(Step 372) . Thereafter, Teller money module B 5 will 
establish a session with Teller money module C 5 at an 
Issuing Bank 1, by performing process Steps 190-258. 

30 A withdrawal is requested by Teller money module 

B 5 to Teller money module C 5 using process Steps 920-928 
described above. To obtain the notes 11 for the request. 
Teller money module C 5 must get them from a Money 
Generator module 6. Accordingly, a session is established 

35 between the two money modules via Steps 190-258, and the 
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notes 11 are requested following process Steps 780-792 
outlined above. 

The Money Generator module 6 will create the 
notes 11 requested and transfer them to Teller money 
module C 5 using process Steps 750-770. This is followed 
5 by a posting to the proper accounts in the (bank's systems 
(Step 374), see Figure 16, step 3 for accounting 
transactions) . The notes ll are now transferred from 
Teller money module C to Transaction money module A 4 via 
Teller money module B 5 using for each transfer the 

10 process steps 750-770. Finally, all the sessions must be 
committed, and Transaction money module A 4 commits to 
Teller money module B 5 who in turn commits to Teller 
money module C 5 using Steps 690-698. Teller money module 
C 5 commits to the Money Generator module 6 to complete 

15 the exchange of dollars for pounds. 

Updating Notes, Certificate 

As mentioned above, it is anticipated that the 

20 date of expiration of a note, used as a security measure, 
may expire while it is stored in a Transaction money 
module 4. If this occurs, the holder of expired notes 11 
will not be able to transfer them to another Transaction 
money module 4, but the holder may deposit them or 

25 exchange them for new notes 11 by transacting with a 
participating bank or financial institution. 

Additionally, if the certificate associated with 
a particular Transaction money module 4 expires, the 
subscriber must sign on the Network 25 to update the 

30 certificate in order to transact with another Transaction 
money module 4 . The following is a description of the 
process flow for updating an expired certificate or 
expired notes 11. 

Beginning at the top of Figure 50, a subscriber 

35 signs on to the Transaction money module 4 using the Steps 
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o 10-42 described above, and is prompted by To Subscriber A 
33 to select a transaction (Step 570) . After selecting 
the transaction for "updating" (Step 572) , a sign-on to 
the Network 25 is performed using Steps 50-168. The sign- 
on -to the Network 25 will perform the updating of the 

5 certificate, as described above with reference to Figure 
33-33A. 

For updating the notes 11, the Session Manager A 
31 sends the update notes request to the Network 25 (Step 
574) ; the Network Server 26 responds by sending the 
1Q selected bank identifier back to the Transaction money 
module 4 (Step 576) . Now, a session may be established 
between the Transaction money module A 4 and the Teller 
money module B 5 of the bank selected, using Steps 190- 
258. 

15 Once the session is established, To Teller A 34 

sends the request to update notes 11 (Step 578) using the 
message sending routine in Steps 2-8 . To Transactor B 32 
responds. Fig. 50A, with an acknowledgement (Step 580) 
sent using Steps 2-8. Transaction money module A 4 can 

2Q now transfer the expired notes 11 to Teller money module B 
5 using Steps 750-770. Thereafter, the corresponding 
accounting (see Figure 24, Step 1) is performed in the 
bank's records (Step 582) , and a session is established 
between Teller money module B 5 and the Honey Generator 

2 ^ module 6 through Steps 190-258. 

The request notes routine of Steps 780-792 is 
then performed. The Money Generator module 6 sends the 
requested notes 11 via Steps 750-770, and updates the 
accounts at the bank (Step 584; see also Fig. 24, Step 2). 

3Q Teller money module B 5 takes the updated notes 11 and 
passes them to Transaction money module A 4 using the same 
Steps 750-770. 

Now that the notes 11 have been updated in the 
Transaction money module 4, the sessions are completed by 

. having Transaction money module A 4 commit to Teller money 
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o module B 5, and having Teller money module B 5 then commit 
the transaction with the Money Generator module 6. 
Finally, both committing routines are performed using 
Steps 690-698 described above. 

The above described process flows illustrate the 
5 capability of the invention to provide an improved system 
for exchanging electronic representations of economic 
value, while avoiding the inherent limitations of paper 
based monetary systems. 

Operation of the invention has been described 

1Q primarily with currency notes and credit notes that can be 
used by subscribers in the same processes. It will be 
understood that the described system can also be adapted 
to other monetary instruments. For example, personal and 
corporate checks and bank drafts could be provided by 

15 enhancing several of the Transactor applications. More 
complicated multiparty payment processes such as letters 
of credit and banker's acceptances could also be provided 
with appropriate changes to the system. It may also be 
possible to adapt the system of the invention to provide 

2Q corporate financial obligations such as commercial paper. 
Moreover, although the invention has been 
described in detail with particular reference to a 
preferred embodiment thereof, it should be understood that 
the invention is capable of other and different 

25 embodiments, and its details are capable of modifications 
in various obvious respects. As is readily apparent to 
those skilled in the art, variations and modifications can 
be affected while remaining within the spirit and scope of 
the invention. Accordingly, the foregoing disclosure, 

30 description, and figures are for illustrative purposes 
only, and do not in any way limit the invention, which is 
defined only by the claims. 



35 
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I*f THE CLAIMS 

1. An electronic monetary system for providing 
transactions utilizing electronic representations of 
currency backed by demand deposits in a bank comprising: 

5 

means for generating said electronic 
representations of currency? 

teller means for issuing and 
10 distributing said electronic 

representations of currency; 

transacting means for storing, and for 
transferring said electronic 
15 representations of currency between 

other transacting means and between 
said transacting means and said teller 
means. 

20 2- An electronic monetary system for providing 

transactions utilizing electronic representations of 
credit authorizations comprising: 

means for generating said electronic 
25 representations of credit; 

teller means for issuing and 
distributing said electronic 
representations of credit; 

30 

transaction means for storing, and for 
transferring said electronic 
representations of credit between 
other transacting means and between 
35 said transacting means and said teller 
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3. An electronic monetary system according to 
claim 1 or claim 2 further comprising a means for 
maintaining the security and integrity of said electronic 
monetary system. 

4. An electronic monetary system according to 
claim 1 or claim 2 further comprising a means for 
providing a communication network between said generating 
means, said teller means, said transacting means, and said 
security ] 



5. An electronic monetary system according to 
claim 1 or claim 2 further comprising a means for 
maintaining and processing account data files for storing 
records of said electronic representations of currency or 
credit issued by said generating means and records of said 
electronic representations of -currency or credit 
transferred by said transacting means to said teller 



6. An electronic monetary system according to 
claim 3 wherein said security means further comprises a 
time limit on the transferability of said electronic 
representations of credit and said electronic 
representations of currency among said transacting means. 

7 . An electronic monetary system according to 
claim 3 wherein said generating means, said teller means 
and said transacting means each comprise an individual 
identifier, and said means for maintaining the security of 
said electronic monetary system further comprises a 
certification means for providing a unique certificate of 
said identifier of each of said generating means, said 
teller means and said transacting means. 
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8. An electronic monetary system according to 
claim 7 wherein said certificate further comprises a time 
limit on its acceptability by said generating means, said 
teller means or other of said transacting means. 

9. An electronic monetary system according to 
claim 1 or claim 2 wherein said generating means further 
comprises a public key digital forming means for forming a 
digital signature on said electronic representations of 
currency or said electronic representations of credit. 

10. An electronic monetary system according to 
claim 1 or claim 2 wherein said teller means further 
comprises a public key digital forming means for forming a 
digital signature on said electronic representations of 
currency or said electronic representations of credit. 

11. An electronic monetary system according to 
claim 1 or claim 2 wherein said transacting means further 
comprises a public key digital forming means for forming a 
digital signature on said electronic representations of 
currency or said electronic representations of credit. 

12. An electronic monetary system according to 
claim 1 or claim 2 wherein said electronic representations 
of currency or said electronic representations of credit 
are undeniably acceptable as economic value. 

13. An electronic monetary system according to 
claim 1 or claim 2 wherein said electronic representations 
of currency or said electronic representations of credit 
are commutable and trans f err able in values less than or 
equal to their original economic value when generated. 



35 



14. An electronic monetary system according to 
claim 13 wherein said electronic representation of credit 
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° is -transferable only one time by said transacting means. 

15. An electronic monetary system according to 
claim 1 or claim 2 wherein said electronic representations 
of currency or said electronic representations of credit 

5 further comprise indicia of 

(1) whether said representation is a currency 
or a credit representation, 

(2) its said time limit of transferability, and 

(3) its economic value. 

10 

16. An electronic monetary system according to 
claim 15 Wherein said indicia further comprise indicia of 

(1) said certificates of said other transacting 



15 (2) said certificates of said teller means, and 

(3) said certificate of said generating means. 

17. An electronic monetary system according to 
claim 16 wherein said indicia further comprise indicia of 
20 (l> a digital signature of said generating 



(2) a digital signature of said teller means, 
and 

(3) a digital signatures of said other 
25 transacting means. 

18. An electronic monetary system according to 
claim 1 or claim 2 wherein said generating means, said 
teller means, and said transacting means are each 
30 comprised of a programmable processing device contained in 
a tamper-proof housing. 



19. An electronic monetary system according to 
claim 18 wherein said generating means, said teller means, 
35 and said transacting means are configured to perform as a 
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modular co-processor of a general purpose computer. 

20. An electronic monetary system according to 
claim 18 wherein each of said programmable processing 
devices further comprises a list of other offending 
programmable processing devices. 

21. An electronic monetary system according to 
claim 1 or claim 2 further comprising a means for clearing 
said electronic representations of credit and currency 
issued by more than one bank. 

22. An electronic monetary system according to 
claim 1 or claim 2 wherein said financial facilities 
further comprise an accounting structure to monitor the 
distribution of said electronic representations of 
currency or said electronic representations of credit and 
each financial facility's obligation after any financial 



23. An electronic monetary system according to 
claim 18 wherein said programmable processing device in 
said transacting means further comprises separate lists 
for accounts associated with the owner of said transacting 
means that are held at each of said different financial 
facilities. 

24. An electronic monetary system according to 
claim 23 wherein each of said list of accounts further 
comprises a digital signature of the financial facility 
maintaining said accounts, to provide security from 
unauthorized access of said accounts. 



35 



25. An electronic monetary system according to 
claim l or claim 2 wherein said generating means is 
configured to generate said electronic representations of 
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currency or said electronic representations of credit for 
a plurality of monetary units. 

26. An electronic monetary system according to 
claim 18 wherein each of said programmable processing 
devices can be personally coded to prohibit use by 
unauthorized persons, such coding being performed by an 
individual that does not have any relationship with any of 
said financial facilities, and whose identity remains 
anonymous . 

27. A monetary system using electronic 
representations of money and including at least one 
financial facility and subscribers served by said 
facility, said system comprising: 

a plurality of subscriber processors, 
each adapted to contain said 
electronic representations in the form 
of machine readable digital objects 
containing data indicative of the 
monetary value represented and the 
current validity of said 
representations j 

25 processing means operated by said 

financial facility and capable of 
communicating with said subscriber 
processors for the deposit in said 
facility of representations stored in 

30 said subscriber processors, or the 

withdrawal or representations from 
said facility to said subscriber 
processors ; 



10 



15 



35 



said subscriber processors also 
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including communication and processing 
functions enabling exchange of said 
representations between subscriber 



processors . 



5 



28. A system according to claim 27 in which 



said money representations are configured to be 
functionally equivalent to bank notes. 

29. A system according to claim 27 including a 
10 certification source enabling the processing of said 

representations to indicate their validity. 

30. A system according to claim 27 in which 
there are a plurality of said financial facilities and a 

15 clearing facility for clearing transactions among said 
financial facilities and said subscriber processors. 

31. A system according to claim 27 in which 
said data stored in said subscriber processors includes 

20 data representations for ascertaining the status of said 
representations . 



said electronic representations of money stored in said 
25 subscriber processors are replaced with updated 

representations during transactions with said financial 
facility. 

33. A monetary system using electronic media to 
30 securely and reliably exchange economic value, said 
monetary system comprising: 



32. A system according to claim 27 in which 



electronic representations of credit 
authorizations and electronic 
representations of currency backed by 



PCT/US92/09732 



- 109 - 
demand deposits in a bank; 

means for generating said electronic 
representations of credit and said 
electronic representations of 
currency; 



teller means coupled to said 
generating means for issuing, 
distributing, and accepting said 
10 electronic representations of credit 

and currency; and 



transacting means for storing, and for 
transferring said electronic 
15 representations of credit and currency 

with other transacting means and 
between said transacting means and 
said teller means. 



34. A monetary system according to claim 33 
further comprising a means for transmitting said 
electronic representations in a secure manner between said 
generating means, said teller means and said transmitting 
means to maintain the security and integrity of said 
monetary system. 

35. A monetary system according to claim 34 
wherein said security means further comprises a time limit 
on the transferability of said electronic representations 

30 of credit and currency among said transacting means. 

36. A monetary system according to claim 34 
wherein said generating means, said teller means and said 
transacting means each comprise an individual identifier, 

35 and said means for maintaining the security of said 
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monetary system further comprises a certification means 
for providing a unique certificate of said identifier of 
each of said generating means, said teller means and said 
transacting means. 

37. A monetary system according to claim 36 
wherein said certificate further comprises a time limit on 
its acceptability by said generating means, said teller 
means or other of said transacting means. 

38. A monetary system according to claim 34 
further comprising a networking means for providing a 
communication link between said generating means, said 
teller means, said transacting means, and said security 



39. A monetary system according to claim 33 
wherein said generating means is configured for generating 
said electronic representations of credit and currency for 
a plurality of monetary units. 

40. A monetary system according to claim 33 
wherein said electronic representations of credit and 
currency are undeniably acceptable as economic value, and 
are commutable and transferrable in values less than or 
equal to their original economic value. 

41. A monetary system according to claim 40 
wherein said electronic representation of credit is 
transferable only one time by said transacting means. 

42. A monetary system according to claim 33 
wherein said generating means further comprises a public 
key digital forming means for forming a digital signature 
on said electronic representations of credit and currency. 
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43. A monetary system according to claim 33 
wherein said teller means further comprises a public key 
digital forming means for forming a digital signature on 
said electronic representations of credit and currency. 

5 44. A monetary system according to claim 33 

wherein said transacting means further comprises a public 
key digital forming means for forming a digital signature 
on said electronic representations of credit and currency. 

10 45. A monetary system according to claim 41 

wherein said electronic representations of credit and 
currency comprise indicia of 

(1) whether said representation is a currency 
or a credit representation, 
15 (2) its said time limit of transferability, 

(3) its economic value, 

(4) said digital signature of said generating 



(5) said digital signatures of said teller 



(6) said digital signatures of other 
transacting means, 

(7) said certificates of other transacting 



25 (8) said certificates of said teller means, 

(9) said certificate of said generating means, 
and 

(10) an identifier of said electronic 
representation of currency or credit. 

30 

46, A monetary system according to claim 33 
wherein said generating means, said teller means, and said 
transacting means are each comprised of a programmable 
processing device contained in a tamper-proof housing. 

35 



WO 93/10503 PCT/US92/09732 



- 112 - 

• 47. A monetary system according to claim 46 

wherein said generating means, said teller means, and said 
transacting means are configured to perform as a modular 
co-processor of a computer. 

5 48. A monetary system according to claim 33 

further comprising a means for clearing said electronic 
representations of credit and currency issued by more than 
one bank. 

10 49. A method of using electronic 

representations of currency or electronic representations 
of credit provided by at least one financial facility 
having a means for generating said electronic 
representations, and a teller means for issuing and 

15 accepting said electronic representations and serving 
subscribers of said facility, comprising the steps of: 

(1) generating said electronic representations 
of currency backed by demand deposits or 

20 generating said electronic representations 

of credit authorizations; 

(2) issuing to said subscribers and accepting 
from said subscribers electronic 

25 representations of currency or credit, 

wherein the issuance and acceptance is 
performed by said teller means at said 
financial facility; and 

30 (3) providing said subscribers with a 

transacting means for accepting said issued 
electronic representations of currency or 
credit, and for transferring said 
electronic representations of currency or 

35 credit to both other subscribers having 
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said transacting means, and to said teller 
means . 



50. The method of claim 49 further comprising 
the step of digitally signing said electronic 

5 representations of currency or credit to provide 
authenticity and security from duplication or 
modification. 

51. The method of claim 50 further comprising 
10 the step of limiting the time period that said electronic 

representations of currency or credit may be transferred 
among said transacting means. 

52 . The method of claim 51 further comprising 
15 the step of removing all of said electronic 

representations of currency stored in said transacting 
means whenever said transacting means transacts with said 
financial facility, the step of generating new electronic 
representations of currency having a renewed time limit on 
20 transferability, and the step of replacing said original 

electronic representations of currency in said transacting 
means with said new electronic representations of 
currency. 

25 53. The method of claim 51 further comprising 

the step of removing all non- transfer red electronic 
representations of credit authorizations stored in said 
transacting means only whenever said transacting means 
transacts with the financial facility issuing said 

30 electronic representations of credit, the step of 

generating new electronic representations of credit having 
a renewed time limit on transferability, and the step of 
replacing said original electronic representations of 
credit in said transacting means with said new electronic 

35 representations of credit. 
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54. The method of claim 49 further comprising 
the steps of clearing, and maintaining records of said 
electronic representations of currency or credit issued by 
said financial facilities. 

55. The method of claim 49 further comprising 
the step of providing an identifier unique to each of said 
generating means, said teller means and said transacting 



56. The method of claim 55 further comprising 
the step of certifying for a limited period of time the 
validity of said identifier of each of said generating 
means, said teller means and said transacting means. 

57. The method of claim 56 further comprising 
the step of providing a list of any offending teller 
means, generating means, or transacting means to each of 
said generating means, said teller means and said 
transacting means. 

58. The method of claim 49 further comprising 
the step of generating said electronic representations of 
credit and currency for a plurality of different monetary 
units. 

59. The method of claim 49 further comprising 
the step of providing an accounting structure at said 
financial facilities to monitor the distribution of said 
electronic representations of currency or credit, and each 
financial facility's obligation after any financial 
transaction. 



35 



60. The method of claim 59 further comprising 
the step of storing in said transacting means separate 
lists for accounts associated with said subscriber at each 
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of said financial facilities. 



61. The method of claim 60 further comprising 
the step of digitally signing each of said list of bank 
accounts with the digital signature of the corresponding 
5 financial facility, to provide security from unauthorized 
access of said accounts. 



62. The method of claim 55 further comprising 
the step of maintaining records of transactions undertaken 

10 by said generating means, said teller means and said 

transacting means and storing said records within each of 
said respective generating means, said teller means and 
said transacting means, wherein said transaction record 
includes indicia of the -date of transfer, the amount of 

15 transfer, an identifier of the financial facility issuing 
said electronic representations of currency or credit, and 
an identifier of the electronic representation of currency 
or credit transferred. 



20 63. The method of claim 62 further comprising 

the step of maintaining copies of said electronic 
representations of currency and credit issued at said 
financial facilities, and the step of updating said copies 
upon transacting with any of said transacting means. 

25 

64. The method of claim 63 further comprising 
the step of reconciling said copies of electronic, 
representations of currency and credit with electronic 
representations of currency and credit that have been 

30 cleared in said financial facilities. 

65. The method of claim 64 further comprising 
the steps of: 

(1) storing records of individual transactions 
35 that have occurred among said transacting 
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° means -to a separate storage means, 

(2) submitting said records of individual 
transactions stored in said storage means 
to said financial facilities when said 
electronic representations of currency or 

5 credit are stored in a transacting means 

that becomes lost or stolen, and 

(3) comparing said records of individual 
transactions among said transacting means 
with records produced by said 

10 reconciliation of said electronic 

representations of currency and credit to 
determine the true value of said electronic 
representations of currency and credit 
stored in said transacting means that may 

15 be lost or stolen, for accurate replacement 

of said value lost. 

66. The method of claim 49 further comprising 
the step of providing a communication network, linking 
20 together said financial facilities and said transacting 




SUBSTITUTE SHEET 



WO 93/10503 



PCT/US92/09732 



2/68 



FIG. 2 



l_ 



L 



TRANSACTION 
MONEY 
MODULE 



MONEY 




MONEY ISSUED 
RECONCILIATION 
SYSTEM 



PROBLEM 
REPORTS 





SECURITY 


► 

PROBLEM 
REPORTS 


SYSTEM 



CERT1- 
RCATES 



0 



BANK 
POSITION 



BAD 
MONEY 
MODULE LIST 



MONEY 
POSITION 
SYSTEM 



1-24 



NETWORK 25 (NOT SHOWN) 



ELECTRONIC MONETARY SYSTEM 



SUBSTITUTE SHEET 



WO 93/10503 



PCT/US92/09732 



4/68 

FIG. 4 

| HUMAN INTERFACE | | LOCAL PROCESSOR | | COMMUNICATIONS | 





EXTERNAL INTERFACE 


30 






SESSION MANAGER 


31 




TRANSACTOR 32 


MONEY HOLDER 


38 


TO 33i 
SUBSC^BER : 


TO 34 
TELLER 


NOTE 39 
DIRECTORY 


NOTES 


40 


PAY/ ^ TRAN 1 MAIN-37 
EXCHANGE jLOG SECURITY 


PACKET 41 
MANAGER 


VERIFIER 


42 


SERVICES 


43 

CLOCK/ 
TIMER 


CRYPTOGRAPHY 


PUBLIC 44 
KEY 
ALGORITHMS 


SYMMETRIC 45 

KEY 
ALGORITHMS 


RANDOM 
NUMBER 
GENERATOR 


46 



TRANSACTION MONEY MODULE 



SUBSTITUTE SHEET 



PCT/US92/09732 



FIG. 5 



LOCAL PROCESSOR | | COMMUNICATIONS | 



I 





EXTERNAL INTERFACE 


30 




SESSION MANAGER 


31 


TRANSACTOR 32 


MONEY HOLDER 38 


TO 47] *TO 34*1 TO MONEY 48 
, BANK : TELLER iGENERATOR 


NOTE 39 
DIRECTORY 


NOTES 40 


TRAN LOG I ma'SaIN I ^.J& 
MANAGER i SECURITY: T8£NS- 

36: 37i ACTION 49 


PACKET 41 
MANAGER 


42 

VERIFIER 


SERVICES 


43 

CLOCK/ 
TIMER 


CRYPTOGRAPHY 


PUBLIC 441 SYMMETRIC 45 
KEY KEY 
ALGORITHMS ALGORITHMS 


RANDOM 46 
NUMBER 
GENERATOR 



TELLER MONEY MODULE 



SUBSTITUTE SHEET 



WO 93/10503 



PCT/US92/09732 



6/68 



FIG. 6 

1 LOCAL PROCESSOR | | COMMUNICATIONS | 







EXTERNAL INTERFACE 


30 








SESSION MANAGER 


31 




TRANSACTOR 32 


MONEY HOLDER 


38 


TO 47: 
BANK i 




TO 34 
TELLER 


NOTE 39 
DIRECTORY 


NOTES 


40 


TRANLOG ! 
MANAGER 1 
36: 


MAINTAIN j MONEY 
SECURITY i CREATOR 
37: 50 


PACKET 41 
MANAGER 


VERIFIER 


42 


SERVICES 


CLOCK/ 
TIMER 


43 


CRYPTOGRAPHY 




PUBLIC 441 SYMMETRIC 45 
KEY KEY 
ALGORITHMS ALGORITHMS 


RANDOM 
NUMBER 
GENERATOR 


46 



MONEY GENERATOR MODULE 



SUBSTITUTE SHEET 



WO 93/10503 PCI7US92/09732 

8/68 

FIG. 8 





EXTERNAL INTERFACE 


56 


COMMUNICATION SESSION MANAGER 57 


APPLICATION SERVICES 


58 MANAGE 
NETWORK 
SIGN-ON 


59 SYNCHRONIZE 
TIME/ 
DATE 


ROUTE 60 
MESSAGE 


DIRECT TO 61 
BANK SERVICE 



NETWORK SERVER 



SUBSTITUTE SHEET 



PCT/US92/09732 



FIG. 9 



4,5,6 ACCOUNT PROFILE 

<^ BAD MONEY MODULE LIST 




27 



BAD MONEY 
, MODULE LIST 



SECURITY SYSTEM 



SUBSTITUTE SHEET 



10/68 PCT/US92/09732 
FIG. 10 



External Interface « 


Session Manager ss 


so 

Create 
Certificate 


Create 51 
Account 
Profile 


Distribute 
Certification 
Keys 


S3 

Control Bad 
Money Module 
Lost 


Services 


43 

. Clock/ 
Timer 


Cryptography 


Public 
Key 44 
Algorithms 


Symmetric 

Key « 
Algorithms 


Random 46 
Number 
Generator 



Security Server 



WO 93/10503 



11/68 



PCT/US92/09732 



I I 



<t:§ % 
ill I 



Bi 
88 



is 
8 |8 



It 



II . 



a Si 



5 fc 



I I 



II I III 



o •» o 



12/68 



PCT/US92/09732 



III 



1 I 



H 

9 
1, 



§§ 

o So 

S8§ i 



HI 
I | 



ill 



1 1 



4 
II 



2 JJ 



Iff 

11 



111 



13/68 



PCT/US92/09732 



II 
5i& 



It 

■»■ 



II 



mi 



ss 
S3 

III 

g O Q 



II. 



*t i 



a 



S 3 

, i 



f 



PCT/US92/09732 



111 



el 

88 i : 
aa If 



= If 

8Si 
888 
eaa 



ill 



ill 



I 
i 



If 



ill 



f 



PCT/US92/09732 



15/68 



Ill 
zSS 



if 
ii 

ill 



2£ s t 



| I is I 



H | j 
C9 | 1 

E III 



ill 



if 



5 S S S 



til 



1 ill 



PCT/US92/09732 



1 

4. 
ill 

t\ 



Hi 

u 

ill 

h 
I 

A 



2 

a go 




8 SS 



I 
1 



ii 



C si 



If 



I 

i 



17/68 



S S 2 2 



i! 



I! 



PCT/US92/09732 



WO 93/10503 



18/68 



PCT/US92/09732 



<2§8 

lis! 



g 



§1 

23 o 



ill 
in 



i9/6a 



PCI7US92/09732 



ill 

If 
11 



HI 



ii, 



if! 

£ 

I 



I 
I 
s 

II 



el Si 



II I! * 

o a o q 



t 2 



1 3* | i 

" ° » is 



o J* ~" 



3 S 
<2 S> 



PCT/US92/09732 



SB 



II 31 



8& eg gs gs 



Is 18 II i 



» a o o 



o v> 



ii I 




8 

ill 



3 5g 



s S § 



WO 93/10503 



iii 
!! 



111 



Hi 



• 






| f t 
1 II 


Is 
**©. 


9 ' s ° 

7 




ti a 


*>C$1(X 

.D$10« 

Reque 


$50 

_D$50 
C$50 

I "$50 


\ 

© J 


$100 
-$150 



PCT/US92/09732 



I 3 

I * s jp g 

lllll 



3 s 



PCT/US92/09732 



n 



§8 



* i 



it 

fc s 

gg 



, II 



I I 



S 

8 
a 

1 1 
2 5 



9 8 S - 



9 88 

O Q 

_l 



I 1 I 



if 
II 



III. 



s § 



^sl 1 

if Sail 



PCT/US92/09732 



Ii 



II 



1, 



Ii 



u 



ii 
IS 



2 
8 



is 



11 ,11 

Iliiii 



PCI7US92/09732 



! 

iff 

i 
I 

m 

I 
il 1 



i II I 



1? I 

I I II I 



B 5 S s 

ii 



t 
i 




Transaction Reconciliation System 




Money Issued Reconciliation System 



28/68 
FIG. 28 



PCT/US92/09732 



Set us wK 




A^Te 





Check notes transferred 




(see accounting) 



Teller B-»MG 



Post Accounting Transaction 



1 1 

Request Notes 


'780-792 


Teller B-»MG 








Transfer Notes 
MG«+ Teller B 


-750-770 






Transfer Notes 
Teller B-»A 


-750-770 






A •* Teller B 


-690-598 






Teller B «* M6 


'690-598 



Withdrawal from Issuing Bank 



29/68 PCT/US92/09732 
FIG. 29 



prompt for transaction 











bank, and account # 


-44 










Money Module 
Network Sign on A 


-so-isa 




♦ 




Establish session 
A -* Teller B 


-190-258 




* 




Request Withdrawal 
A -a Teller B 


-700-724 








ToTeUerA 

Transfer total of currency and 
transferred credit notes 


-45 




~ ^^^46 


1 




To Teller A 

Send message no rotes 






* 




Transfer Notes 


-7SO-77Q 


Send Message 
A •» Teller B 




A •» Teller B 







[ 



Setup Withdrawal 



PCT/US92/09732 



30/68 

TO TELLER X 

SEND WITHDRAWAL REQUEST, 
AMOUNT, ACCOUNTS ACCOUNT PROFILE 



-700 FIG. 30 



SEND MESSAGE 

X-*Y 



--2-8 



VALIDATE ACCOUNT NUMBER 



-7041-7056 



TO BANK Y 

VERIFY THERE IS SUFFICIENT FUNDS 



-704 



706 



YES 




TO TRANSACTION Y 
SEND ACKNOWLEDGEMENT 






r 






SEND MESSAGE 

Y-*X 


—2-8 






r 


/714 


TO TELLER X 

RECEIVE ACKNOWLEDGEMENT 




(RETURN 



REQUEST WITHDRAWAL 



SUBSTITUTE SHEET 



PCT/US92/09732 



31/68 

FIG. 30A 



TO TRANSACTION Y 

SEND MESSAGE 
INSUFFICIENT FUNDS 



-718 



SEND MESSAGE 

Y-*X 



-2-8 



724 

jL 



TO TELLER X 

SEND AMOUNT 



SEND MESSAGE 

X-^Y 



TO SUBSCRIBER X 

PROMPT SUBSCRIBER 
FOR NEW AMOUNT 



-—720 




500-524 



ABORT TRANSACTION 

Y-»X 



-2-8 



REQUEST WITHDRAWAL (CONTINUED) 



SUBSTITUTE SHEET 



PCT/US92/09732 



FIG. 31 



SUBSCRIBER PROMPTS FOR SIGN ON [ — 1n 



I 



SESSION MANAGER 

RECEIVE PROMPT NOTE SIGN ON SESSION 
CHECK IF SIGN ON INHIBITED 



SESSION MANAGER 
CHECK TIMER 




^-12 



TO SUBSCRIBER 

SEND SUBSCRIBER 
SIGN ON INSTRUCTION 



-22 



TO SUBSCRIBER 

SEND MESSAGE 
SIGN ON INHIBITED 



SUBSCRIBER PERFORMS --24 
SIGN ON TASK 



SESSION MANAGER 

RECEIVE SIGN ON DATA 



~— 26 



TO SUBSCRIBER 

VERIFY SIGN ON INFORMATION 



—28 




SESSION MANAGER r~32 
NOTE SIGN ON VALID 



SUBSCRIBER MONEY MODULE SIGN ON 
SUBSTITUTE SHEET 



PCT/US92/09732 



33/68 

FIG. 31 A 



SESSION MANAGER 
NOTE SIGN ON INHIBITED 



CLOCK/TIMER 
SET TIMER 



TO SUBSCRIBER 

SEND MESSAGE SIGN ON INVALID 




YES^ ^ATTEMPTS^ 
^THRESHOLD?. 



^42 



SESSION MANAGER 
NOTE SIGN ON TERMINATED 



SUBSCRIBER MONEY MODULE SIGN ON 



SUBSTITUTE SHEET 



PCT/US92/09732 



FIG. 32 



ABORT TRANSACTION 
X-*Y 



SESSION MANAGER 

ROLL-BACK CHANG ES 



^-500 



SESSION MANAGER X 
NOTE TRANSACTION ABORTED 



^-502 



510^ 




CTION^ 
MM? 

YES 



NO 



512, 



TO SUBSCRIBER X 

SEND MESS AGE TRANSACTION ABORTED 

I 



SESSION MANAGER X 

SEND MESSAGE TO Y THAT 
TRANSACTION CANNOT BE COMPLETED 



SEND MESSAGE 



2-8 



SESSION MANAGER Y 
ROLL-BACK CHANGES "—51 4 



508 




TO BANK X 

REVERSE ACCOUNTING 
TRANSACTIONS 



524. 



SESSION MANAGER Y 

NOTE TRANSACTION ABORTED 




— - 516 



520 



TO SUBSCRIBER Y 

SEND MESSAGE TRANSACTION ABORTED 



522 




TO BANK X 

REVERSE ACCOUNTING 
TRANSACTIONS 



| ABORT TRANSACTION MONEY MODULE TO MONEY MODULE 



SUBSTITUTE SHEET 



PCT/US92/09732 



SESSION MANAGER A —50 

ESTABLISH COMMUNICATION 



FIG. 33 



NETWORK SERVER I — 52 

REQUEST CERTIFICATE 



0 



SESSION MANAGER A 
RECEIVE REQUEST 

* 



^0 I 



r-62 j 



—-54 



MAINTAIN SECURITY A 
RETREIVE CERTIFICATE 



—56 



0 



-58 



SESSION MANAGER A 

SEND CERTIFICATE TO 
NETWORK SERVER 



NETWORK SERVER 
ROUTE CERTIFICATE TO 
SECURITY SERVER 




-66 



SECURITY SERVER 

SEND MESSAGE TO NETWORK 
SERVER TO DENY ACCESS 



NETWORK SERVER 

SEND MESSAGE TO MM 
TO DENY ACCESS 



-70 



SESSION MANAGER A 

RECEIVE MESSAGE NOTE 
SIGN ON DENIED 




TO BANK A 

SEND MESSAGE 
SIGN ON DENIED 



74^ 



YES 



TO SUBSCRIBER A 

SEND MESSAGE SIGN ON 
DENIED 



MONEY MODULE NETWORK SIGN ON 



SUBSTITUTE SHEET 



PCT/US92/09732 



SECURITY SERVER 

SEND BAD MONEY MODULE 
LIST AND NEW LIST OF 
CERTIFICATORY KEYS 
SIGNED USING LAST VERSION 
OF CERTIFICATORY KEY AND NOTICE 
TO RECERTIFY (IF NEEDED) 



—78 



FIG. 33A 



SESSION MANAGER A 
RECEIVE MESSAGE 



—80 



MAINTAIN SECURITY A 
VALIDATE LISTS 



—82 



PUBLIC KEY A 

VALIDATE SIGNATURE 



86 




—84 



VAUD? 



NO 



YES 



94 — MAINTAIN SECURITY A 
UPDATE BAD MM LIST AND 
CERTIFICATORY KEY LISTS 





YES ^90 



TO SUBSCRIBER A 

SEND MESSAGE NETWORK 
SECURrTY PROBLEM 



TCvBANK A 

SEND MESSAGE NETWORK 
SECURrTY PROBLEM 



100- 



SESSION MANAGER A 
REQUEST DATE AND TIME 



MONEY MODULE NETWORK SIGN ON (CONTINUED) 



SUBSTITUTE SHEET 



PCT/US92/09732 



2. 



CLOCK/TIMER A 
SEND TIME 
AND DATE TO SESSION 
MANAGER 



-102 



FIG. 33B 



SESSION MANAGER A 
SEND DATE 
AND TIME TO NETWORK 
SERVER 



106- 



126- 




1 28— SESSION MANAGER A 
RECEIVE 
ACKNOWLEDGEMENT AND 
NOTE NETWORK SIGN ON 



122- 



TO SUBSCRIBER A 

SEND MESSAGE TO SUBSCIRBER 
CLOCK MALFUNCTION 

-124 



1NO 



I MONEY MODULE NETWORK SIGN ON (CONTINUED) 
SUBSTITUTE SHEET 



PCI7US92/09732 



FIG. 33C 



MAINTAIN SECURITY A 

GENERATE NEW CERTIFICATE 



-126 



PUBLIC KEY A 
GENERATE NEW KEYS AND SIGNS 
CERTIFICATES WITH OLD KEY 



—128 



SESSION MANAGER A 

SEND SIGNED CERTIFICATE TO 
SECURITY SERVER 



—130 



SECURITY SERVER , on 

RECEIVE CERTIFICATE APPLICATION ^"132 



SECURITY SERVER ~— 134 
VALIDATE SIGNATURE 



136 




NO 



SECURITY SERVER 

SIGN CERTIFICATE AND SEND TO MM 138 



0 



MONEY MODULE NETWORK SIGN ON (CONTINUED) 



SUBSTITUTE SHEET 



PCT/US92/09732 



140. 



142. 



39/68 

FIG. 33D 



SESSION MANAGER A 
RECEIVE CERTIFICATE 



MAINTAIN SECURITY A 

VAUDATE CERTIFICATE 



144. 



PUBLIC KEY A 

VAUDATE SIGNATURE 



146 



148~ 




VALID? 
£yES 



NO 



SESSION MANAGER A 

SEND ACKNOWLEDGEMENT 
TO SECURITY SERVER 



166 a 



TO BANK A 

REQUEST FOR RETRY 



SESSION MANAGER A 
SEND MESSAGE AND 
CERTIFICATE TO 
SECURrTY SERVER- 
CERTIRCATE INVAUD 



SECURITY SERVER 

VAUDATE SIGNATURES 



-150 



-152 




SECURITY SERVER 

DISCONNECT FROM NETWORK 



NETWORK SERVER 

SEND MESSAGE OF MALFUNCTION 
TO MM 



-158 



SESSION MANAGER A 

RECEIVE MESSAGE 



464 




-T60 



TO SUBSCRIBER A 

REQUEST SUBSCRIBER FOR RETRY 



MONEY MODULE NETWORK SIGN ON (CONTINUED) 



SUBSTITUTE SHEET 



PCT/US92/09732 



FIG. 34 

SESSION MANAGER A 

CHECK IF NETWORK 
CONNECTION TO ANOTHER 
MONEY MODULE IS REQUIRED 



A 90 




NO ^ONNECTIOfo 
JVIEEDED?^ 



SESSION MANAGER A 
SEND NETWORK SERVER 
REQUIRED DESTINATION 



192 



.194 



NETWORK SERVER 

ESTABLISH UNKTO DESTINATION 
MONEY MODUEL BAND 
SEND ACKNOWLEDGEMENT 



.196 



SESSION MANAGER A a 98 

RECEIVE ACKNOWLEDGEMENT 



MAINTAIN SECURITY A 

SEND CERTIFICATE TO SESSION MGR 



^200 



SESSION MANAGER A \^02 
SEND CERTIFICATE TO B 



SESSION MANAGER B 
RECEIVE CERTIFICATE 



V204 



MAINTAIN SECURITY B 

RECEIVE CERTIFICATE FROM SESSION MGR 



1/206 



| ESTABLISH SESSION-MONEY MODULE TO MONEY MODULE | 



SUBSTITUTE SHEET 



PCT/US92/09732 



-208 



FIG. 34A 



PUBLIC KEYB 

VERIFY A'S CERTIFICATE 



209 



214 




MAINTAIN SECURITY B 

CHECK IF A'S ID IS ON 
BAD MM LIST 



215 



2^6 




AON 
^THE LIST? 



YES 



^2,10 



SESSION MANAGER B 

NOTE SESSION TERMINATED 




TO SUBSCRIBER B 

SEND MESSAGE 
TRANSACTION TERMINATED 



RANDOM NUMBER GENERATOR B 

CREATE RANDOM SESSION KEY 



218 



PUBLIC KEY B 

ENCODE WITH A'S PUBLIC KEY: 
RANDOM SESSION KEY, VERIFICATION 
MESSAGE, CERTIFICATE B 



TO BANK B 

SEND MESSAGE 
TRANSACTION TERMINATED 



21^ 



SESSION MANAGER B 
SEND ENCODED MESSAGE TO A 



220 



222 



SESSION MANAGER A 
RECEIVE MESSAGE 



I ESTABLISH SESSION-MONEY MODULE TO MONEY MODULE (CONTINUTED) 



SUBSTITUTE SHEET 



WO 93/10503 



PCI7US92/09732 



-224 



FIG. 34B 



PUBLIC KEY A 

DECODE MESSAGE AND VERIFY 
B'S CERTIFICATE 



226 



228 




MAINTAIN SECURITY A 

CHECK IF B'S ID IS ON LIST 



YES 



50^524 



ABORT TRANSACTION 
A— B 



CLOCKfllMER A 

RETRIEVE DATE AND TIME AND 
SEND TO MAINTAIN SECURITY 



234 



MAINTAIN SECURITY A 

ASSEMBLE VERIFICATION MESSAGE 
AND DATE AND TIME 



236 



SYMMETRIC KEY A 

ENCODE: VERIFICATION MESSAGE, 
DATE AND TIME, USING RANDOM KEY 



SESSION MANAGER A 

SEND MESSAGE TO B 



SESSION MANAGER B 

RECEIVE MESSAGE 



238 



240 



242 



SYMMETRIC KEY B 
DECODE MESSAGE 



| ESTABLISH SESSION-MONEY MODULE TO MONEY MODULE (CONTINUTED) | 



SUBSTITUTE SHEET 



PCT/US92/09732 



-244 



MAINTAIN SECURITY B 

VERIFY VERIFICATION MESSAGE 



246 



248^ 




FIG. 34C 



MAINTAIN SECURITY B 
RETRIEVE DATE AND TIME FROM CLOCK 
SERVICE AND COMPARE TO A'S DATE 




YES 



500^524 



ABORT TRANSACTION 
B-*A 



SESSION MANAGER B 

NOTE START OF SESSION 



254 



SESSION MANAGER B 
SEND ACKNOWLEDGEMENT TO A 



SEND MESSAGE 
B— A 



2-8 



256 



SESSION MANAGER A 
RECEIVE ACKNOWLEDGEMENT 



SESSION MANAGER A 
NOTE START OF SESSION 



i5 58 



| ESTABLISH SESSION-MONEY MODULE TO MONEY MODULE (CONTINUTED) | 



SUBSTITUTE SHEET 



PCT/US92/09732 



FIG. 35 



SET UP WITHDRAWAL 
A— ►TELLER B 



ESTABLISH SESSION 
TELLER B-*-TELLER C 



-43-48 
—190-258 



TO BANK B 

POST ACCOUNTING TRANSACTIONS ^"900 
(SEE ACCOUNTING) 



TO TRANSACTION B 
NOTES TRANSFERRED? 



90 



9 06-^ 




r-902 



NO 



YES 



TO BANK B 

POST ACCOUNTING TRANSACTION 
(SEE ACCOUNTING) 



920-^28 I REQUEST DEPOSIT 

TELLER tB --►TELLER C 



750-^70 
90 8^ 



TRANSFER NOTES 
TELLER B -^TELLER C 



910- 
2-8- 
912- 
914^ 



TO BANK C 

POST ACCOUNTING TRANSACTIONS 
(SEE ACCOUNTING) 



TO TELLER C 
ACKNOWLEDGE DEPOSIT 



SEND MESSAGE 
TELLER C^TELLER B 



TO TELLER B 
RECEIVE ACKNOWLEDGEMENT 



TO BANK B 

POST ACCOUNTING TRANSACTIONS L_ 
(SEE ACCOUNTING) 1 



0 



WITHDRAWAL FROM CORRESPONDENT BANK 



SUBSTITUTE SHEET 



WO 93/10503 



PCT/US92/09732 



FIG. 35A 



REQUEST WITHDRAWAL 
TELLER B — ^TELLER C 
I 



-700-724 



ESTABUSH SESSION 
TELLER C-*-MG 



REQUEST NOTES 
TELLER C— MG 



TRANSFER NOTES 

MG-»»TELLER C 

I 



M 90-258 
780-792 
750-770 



TO BANK C 

POST ACCOUNTING TRANSACTIONS 
(SEE ACCOUNTING) 

i ~ 



TRANSFER NOTES 
TELLER C -»TELLER B 



TRANSFER NOTES 
TELLER B— A 



COMMIT 
A— ^TELLER B 



COMMIT 
TELLER B-» TELLER C 



f~916 
-750-770 
-750-770 
690-698 
690-698 



COMMIT 
TELLER C-*MG 



—690-698 



WITHDRAWAL. FROM CORRESPONDENT BANK (CONTINUED) 



SUBSTITUTE SHEET 



PCT/US92/09732 



FIG. 36 



| A AGREES TO PAY B AN AMOUNT!— 800 

I A SIGNS ON MONEY MODULE H 0-42 JB SIGNS ON MONEY MODULE I 
1 T 10-42- ^ T ' 



T-806 



PROMPT FOR TRANSACTION 



TO 



808-) PROMPT FOR TRANSACTION 

T 



A CHOOSES TO PAY | "~ 81 ^ 1 g J B CHOOSES TO RECEIVE PAYMENT | 



SESSION MANAGER A 

ESTABLISH COMMUNICATION 



81 6H" 
J-814 



SESSION MANAGER B 
ESTABUSH COMMUNICATION 



190-258- 



ESTABLISH SESSION 
A->B 

31 



TO SUBSCRIBER A 

818- PROMPT FOR AMOUNT OF 
PAYMENT BY TYPE OF NOTE 



820- . 



PAY/EXCHANGE A 
RECEIVE AMOUNT BY TYPE OF NOTE 



822- 



NOTE DIRECTORY A 

CHECK SUFFICIENT FUNDS 



828^ 




NO 



826 



TO SUBSCRIBER A 

PROMPT FOR 
NEW AMOUNT BY 
TYPE OF NOTE 



827- 



PAY/EXCHANGE A 

SEND MESSAGE OF AMOUNT 
VALUE TO B 



500-52* 




ABORT TRANSACTION 
A-^B 



SUBSCRIBER TO SUBSCRIBER PAYMENT 



SUBSTITUTE SHEET 



PCI7US92/09732 



FIG. 36A 



2-8— 



SEND MESSAGE 
A-^B 



83CH TO SUBSCRIBER B 

PROMPT SUBSCRIBER TO VERIFY 
AMOUNT BY TYPE OF NOTE 



832- 



835- 




"CORREC 
^AMOUNT?^. 

YES 



NO* 



834 



PAY/EXCHANGE B 

SEND MESSAGE AMOUNT BY 
TYPE OF NOTE INCORRECT 



PAY/EXCHANGE B 

SEND ACKNOWLEDGEMENT 



SEND MESSAGE 
B-^A 



2-8-4 



836- 



SEND MESSAGE 
B-^A 



PAY/EXCHANGE A 

RECEIVE ACKNOWLEDGEMENT 



838-f 



PAY/EXCHANGE A 

PASS AMOUNT TO MONEY HOLDER 



TRANSFER NOTES 
A-^B 



-750-770 



COMMIT 
B-HV 



-690-698 



SUBSCRIBER TO SUBSCRIBER PAYMENT(CONTINUED) | 



SUBSTITUTE SHEET 



PCT/US92/09732 



48/68 



FIG. 37 



SEND MESSAGE 
X-^Y 



SYMMETRIC KEYX 

ENCODE MESSAGE 



SESSION MANAGER X 

SEND MESSAGE 



SESSION MANAGER Y 

RECEIVE MESSAGE 



SYMMETRIC KEY Y 

DECODE MESSAGE 



-2 



| SEND ENCODED MESSAGE • MONEY MODULE TO MONEY MODULE | 



SUBSTITUTE SHEET 



PCT/US92/09732 



49/68 

FIG. 38 



MAINTAIN SECURITY Y 

RECEIVE ACCOUNT PROFILE SIGNATURE 



-7041 



PUBLIC KEY Y 

VERIFY ACCOUNT SIGNATURE 



-7043 



7046 



^-7048 



MAINTAIN SECURITY Y 

SEND MESSAGE TO 
SESSION MANAGER 
ACCOUNT INACTIVE 




-7042 



W044 



MAINTAIN SECURITY Y 

SEND MESSAGE TO 
SESSION MANAGER 
ACCOUNT PROFILE INVAUD 



TO BANK Y 

SEND ACCOUNT NUMBER TO BANK 



ABORT TRANSACTION 
Y-+-X 

500^524 ( 



MAINTAIN SECURITY Y 

CHECK IF BANK CERTIFICATE HAS CHANGED 



-7049 




VAUDATE ACCOUNT NUMBER 



SUBSTITUTE SHEET 



PCT/US92/09732 



50/68 

FIG. 38A 



2. 



MAINTAIN SECURITY Y 

SEND ACCOUNT PROFILE TO SECURITY SERVER 



-7051 



SESSION MANAGER Y 

SEND MESSAGE TO SECURITY SERVER 



-7052 



7053 



SECURITY SERVER 

RE-CERTIFY ACCOUNT PROFILE AND SEND TO TELLER 



SESSION MANAGER Y 

RECEIVE RE-CERTIFIED PROFILE AND SEND TO MM 



>7054 



SEND MESSAGE 
Y-^X 



K 2-8 



MAINTAIN SECURITY X 

UPDATE PROFILE AND SEND ACKNOWLEDGEMENT 



^7055 



SEND MESSAGE 
X->Y 



yZ-B 



MAINTAIN SECURITY Y 

RECEIVE ACKNOWLEDGEMENT 



^•7056 



VALIDATE ACCOUNT NUMBER (CONTINUED) | 



SUBSTITUTE SHEET 



WO 93/10503 



PCT/US92/09732 



51/68 

FIG. 39 



NOTE DIRECTORY X 

CHOOSE NOTE(S) AND VALUES FOR TRANSFER 



-750 



NOTES X 

CREATE TRA NSFER FOR EACH NOTE 



-752 



PUBLIC KEY X 

CREATE SIGNATURES FOR [HEN >j 



-754 



PACKET MANAGER X 

ASSEMBI^NOTE^Sj^^^ 



-756 



SEND MESSAGE 
X-^Y 



-2-8 



PACKET MANAGER Y 

RECEIVE PACKET AND DISASSEMBLE 



-758 



VERIFIER Y 

VERIFY TRANSFERS TO CERTIFICATES 
AND TOTAL AMOUNT 



-760 




1 



ABORT TRANSACTION 
Y-^X 



500-524 



TRANSFER NOTES 



SUBSTITUTE SHEET 



PCF/US92/09732 

52/68 



FIG. 39A 



PUBLIC KEY Y 

VERIFY SIGNATURES 




-765 



VALID? 

Tyes 



NOTES Y 

PLACE NOTES IN HOLDER 



-768 



NOTE DIRECTORY Y -770 
UPDATE NOTE LOCATION 
AND AMOUNT 



TRANSFER NOTES (CONTINUED) 



SUBSTITUTE SHEET 



PCT/US92/09732 



RG. 40 



TO MONEY GENERATOR X 

SEND REQUEST FOR AMOUNT TO MG 



-780 



SEND MESSAGE 
TELLER X-*-MG 



^-2-8 



TO TELLER MG 

RECEIVE MESSAGE AND NOTIFY 
MONEY CREATOR 



-784 



MONEY CREATOR MG 

CREATE NOTE(S) 



-786 



PUBLIC KEY MG 

SIGN NOTE(S) 



-788 



NOTES MG 
PLACE NOTES IN HOLDER 



-790 



NOTE DIRECTORY MG 

UPDATE DIRECTORY 



-792 



REQUEST NOTES 



SUBSTITUTE SHEET 



WO 93/10503 



PCT/US92/09732 



54/68 

FIG. 41 



TRAN LOG X 

UPDATE TRAN LOG 



^-690 



NO 





UJ7 '^-^MM?^^-^- 




|YES 


692^- 


TO SUBSCRIBER X 

NOTIFY SUBSCRIBER END OF 
TRANSACTION 






I 


693--" 


SESSION MANAGER X 




NOTE END OF SESSION 





SEND MESSAGE 
X-^Y 



^-2-8 



TRAN LOG Y 

UPDATE TRAN LOG 



^-694 




TO SUBSCRIBER X 

NOTIFY SUBSCRIBER END OF 
TRANSACTION 



SESSION MANAGER Y 

NOTE END OF SESSION 



^-698 



COMMIT 



SUBSTITUTE SHEET 



WO 93/10503 



PCI7US92/09732 



FIG. 42 

SETUP DEPOSIT 

A— ►TELLER B 



-398-414 



TO BANK B 

POST ACCOUNTING TRANSACTIONS 
(SEE ACCOUNTING) 



-418 



TO TRANSACTION B 

CHECK DEPOSIT < TOTAL NOTES 



422 



424^ 




-420 



DEPOSIT 



NO 



428^ 



TO TRANSACTION B 

SEND ACKNOWLEDGEMENT 



TO BANK B 

POST ACCOUNTING TRANSACTIONS 
FOR DEPOSITS (SEE ACCOUNTING) 



2-8^ i 



SEND MESSAGE 

TELLER B-*A 



1 90-258-^ ESTABLISH SESSION 

TELLER B-^-MG 



780-792- 



REQUEST NOTES 

TELLER B-^MG 



750-770—- TRANSFER NOTES 
MG— ►TELLER B 



430-^ 



TO TELLER A 

RECEIVE ACKNOWLEDGEMENT 



69 0-698^ 



COMMIT 

A-^TELLERB 



C^D) 



750-770 — TRANSFER NOTES 

TELLER B— *-A 



690-698- 



COMMIT 

A— ►TELLER B 



COMMIT 

TELLER B-*MG 



DEPOSrr TO ISSUING BANK 



SUBSTITUTE SHEET 



PCT/US92/09732 



56/68 



FIG. 43 



I A DECIDES TO DEPOSIT TO A BANKI—-398 
i 

1 A SIGNS ON MONEY MODULE 0-42 



© 



TO SUBSCRIBER A 

PROMPT FOR TRANSACTION 

IE 



^00 



A PICKS DEPOSIT, AMOUNT, BANK 
AND ACCOUNT NUMBER 



-402 



NOTE DIRECTORY A 

CHECK IF THERE ARE SUFFICIENT FUNDS 



404 




MONEY MODULE A 
NETWORK SIGN ON 



410-x 



TO SUBSCRIBER A 

PROMPT FOR NEW AMOUNT 



190-258- 



ESTABLISH SESSION 
A— TELLER B 



412 



Q9nQ n fl . REQUEST DEPOSIT 

920-928--- A— »TELLER B 




408-J" 



TO TELLER A 

TRANSFER TOTAL OF CURRENCY AND 
TRANSFERRED CREDIT NOTES 

_ ^ - - 



SESSION MANAGER A 

SEND MESSAGE TO 
SUBSCRIBER TRANSACTION 
TERMINATED 



750-770-H TRANSFER NOTES 
A— ►TELLER B 



SET UP DEPOSIT 



SUBSTITUTE SHEETT 



PCT/US92/09732 



FIG. 44 



TO TELLER X 

SEND DEPOSIT REQUEST, AMOUNT, 
ACCOUNT #, ACCOUNT PROFILE 



— 920 



SEND MESSAGE 

X-*Y 



-2-8 



VALIDATE ACCOUNT NUMBER 



922 





~^\^MM^^ 

^926 


TO TELLER Y 

SEND ACKNOWLEDGEMENT 


TO TRANSACTION Y 

SEND ACKNOWLEDGEMENT 












SEND MESSAGE 

Y-*X 





-7041-7056 



-924 



TO TELLER X 

RECEIVE ACKNOWLEDGEMENT 



2-8 
928 



REQUEST DEPOSIT 



SUBSTITUTE SHEET 



PCT/US92/09732 



58/68 

FIG. 45 



SET UP DEPOSIT 

A— ►TELLER B 



-398-414 



4^4 



TO TRANSACTION B 

CHECK DEPOSIT<TOTAL NOTES 



TO TRANSACTION B 

SEND DEPOSIT ACKNOWLEDGEMENT 



SEND MESSAGE 

TELLER B— »A 



-2-8 



446- 



TO TELLER A 

RECEIVE ACKNOWLEDGEMENT 



COMMIT 

A >TELLERB 




—440 



TO BANK B 

POST ACCOUNTING TRANSACTIONS 
FOR DEPOSIT (SEE ACCOUNTING) 



—448 



ESTABUSH SESSION 

TELLER B -►TELLER C 



-190-258 



REQUEST DEPOSIT 

TELLER B— *TELLER C 



-—780-792 



TO BANK B — 450 

POST ACCOUNTING TRANSACTIONS 
(SEE ACCOUNTING) 



TRANSFER NOTES --750.770 
TELLER B— ►TELLER C ' 5U //U 



TO BANK C 

POST ACCOUNTING TRANSACTIONS 
(SEE ACCOUNTING) 

I 



—452 



TO TELLER C —454 
SEND DEPOSIT ACKNOWLEDGEMENT 



DEPOSIT TO CORRESPONDENT BANK 



SUBSTITUTE SHEET 



WO 93/10503 



PCT/US92/09732 



59/68 

FIG. 45A 



9 



SEND MESSAGE 

TELLER C — ►TELLER B 



-2-8 



TO TELLER B 

RECEIVE ACKNOWLEDGEMENT 



COMMIT 


NO^ 


TELLER B— ►TELLER C 






^456 



TO BANK B 

POST ACCOUNTING TRANSACTIONS 
(SEE ACCOUNTING) 



~— 460 



REQUEST WITHDRAW ^-920-928 
TELLER B — ^TELLER C 



ESTABLISH SESSION ^-1 90-258 
TELLER C— »MG °° 



REQUEST NOTES 

TELLER C— HWG 



780-792 



TRANSFER NOTES 

MG -►TELLER C 



—750-770 



| DEPOSIT TO CORRESPONDENT BANK (CONTINUED) | 



SUBSTITUTE SHEET 



WO 93/10503 



PCT/US92/09732 



60/68 

FIG. 45B 



® 



TO BANK C 

POST ACCOUNTING TRANSACTIONS 
(SEE ACCOUNTING) 



-462 



TRANSFER NOTES 

TELLER C— ►TELLER B 

i 



TRANSFER NOTES 
TELLER B-*A 

i 



COMMIT 

A-^TELLER B 



-750-770 



—750-770 



—690-698 



COMMIT 
TELLER B-+TELLER C 



—690-698 



COMMIT 

TELLER C-+-MG 



690-698 



DEPOSIT TO CORRESPONDENT BANK (CONTINUED) 



SUBSTITUTE SHEET 



PCT/US92/09732 



61/68 

FIG. 46 



A AGREES TO EXCHANGE WITH ^~ nn 
B $ FOR £ AT RATE * $/£ I 300 



I A SIGNS ON MONEY MODULE H 0-42 J B SIGNS ON MONEY MODULE I 
I -r- 1 -t r\.AO-s* -i 



10-42-" 
1-302 

303" 



TO SUBSCRIBER A 

PROMPT FOR TRANSACTION 

A CHOOSES TO BUY £ FOR $ f 30 305 J 
_ _^ 307 _j. 

-306 



SESSION MANAGER A 

ESTABLISH COMMUNICATION 



TO SUBSCRIBER B 

PROMPT FOR TRANSACTION 

B CHOOSES TO SELL £ FOR $ 



SESSION MANAGER B 

ESTABLISH COMMUNICATION 



190-258- 



308- 



0- 



ESTABLISH SESSION 
A-*B 

j z 



TO SUBSCRIBER A 

PROMPT FOR AMOUNT BY 
TYPE OF NOTE OF $ AND RATE R 



310- 



PAY/EXCHANGE A 

RECEIVE AMOUNT BY TYPE OF 
NOTE AND RATE 



312- 



NOTE DIRECTORY A 

CHECK SUFFICIENT FUNDS 




PAY/EXCHANGE A 

SENT $ AMOUNT 
BY TYPE OF NOTE 
AND RATE TOB 



SUBSCRIBER TO SUBSCRIBER FOREIGN EXCHANGE 



SUBSTITUTE SHEET 



PCI7US92/09732 



SEND MESSAGE 



321 x 



TO SUBSCRIBER B 

PROMPT TO VERIFY $ BY 
TYPE OF NOTE AND RATE 



NOTE DIRECTORY B 

CHECK SUFFICIENT FUNDS 




FIG. 46A 



326-, 



PAY/EXCHANGE B 

SEND VALUES INCORRECT 
MESSAGE 



PAY/EXCHANGE B 

SEND ACKNOWLEDGEMENT 



2-8-^ 



PAY/EXCHANGE B 

SEND INSUFFICIENT FUNDS 
MESSAGE TO A 



SEND MESSAGE 



330-y l~ 



r-0 



SEND MESSAGE 

B-*A 



327^1 



PAY/EXCHANGE A 

PASS AMOUNT TO MONEY HOLDER 



750-77CHl_ 



TRANSFER NOTES 
A-*B 



331- 




50 0-524-^ 



PAY/EXCHANGE B 

PASS AMOUNT TO MONEY HOLDER 



ABORT TRANSACTION 



750-770-x_ 



TRANSFER NOTES 

B-*A 



| SUBSCRIBER TO SUBSCRIBER FOREIGN EXCHANGE (OO^JNUEbTI 



SUBSTITUTE SHEET 



PCT/US92/09732 



63/68 



FIG. 47 1 0-42 -^- [a signs on money module I 

■ J 

334- 



TO SUBSCRIBER A 

PROMPT FOR TRANSACTION 



336-x. 



<2> 



A PICKS FOREIGN EXCHANGE $ 
FOR £, AMOUNT OF $ BY TYPE 
OF NOTE AND BANK (OPTIONAL) 



338-vi 



A 342 



TO SUBSCRIBER A 

PROMPT FOR NEW AMOUNT 




SESSION MANAGER A 

SEND MESSAGE TO 
SUBSCRIBER TRANSACTION 
TERMINATED 

345 



NOTE DIRECTORY A 

CHECK IF THERE ARE 
SUFFICIENT FUNDS 




TO TELLER A 

PROMPT NETWORK FOR LIST 



-348 



SESSION MANAGER A 

SEND REQUEST JO-NETWORK 



-350 



NETWORK SERVER 

SEND UST OF BANKS AND RATES TO A V 352 



SESSION MANAGER A 

RECEIVE UST 



^354 



SETUP FOREIGN EXCHANGE 



SUBSTITUTE SHEET 



PCT/US92/09732 



TO TELLER A 

SEND UST TO SUBSCRIBER 



64/68 

FIG. 47A 

-356 



TO SUBSCRIBER A 

PROMPT SUBSCRIBER FOR 
BANK FROM UST 




REPLY? 
NO 



YES 



SESSION MANAGER A 

SEND MESSAGE TO 
SUBSCRIBER TRANSACTION 
TERMINATED 



-357 



190r258 



ESTABLISH SESSION 
A— *TELLER B 



TO TELLER A 

SEND REQUEST TO EXCHANGE 
$ FOR £ AND AMOUNT OF $ 



SEND MESSAGE 
A-*TELLER B 



-360 



-2-8 



TO TRANSACTION B 

RECEIVE REQUEST AND 
_ SEND $/£ RATE 



-362 



SEND MESSAGE 
TELLER B-*A 



-2-8 



500-524 



ABORT TRANSACTION 
A-*B 



TO SUBSCRIBER A 

PROMPT WITH BANK £/$ RATE 




^-364 



•770 



TRANSFER ($) NOTES 
A-»TELLERB 



SET UP FOREIGN EXCHANGE (CONTINUED) 



SUBSTITUTE SHEET 



PCT/US92/09732 



FIG.48 



1 SET UP FOREIGN EXCHANGE"t —334-366 



TO BANK B 

POST ACCOUNTING TRANSACTIONS 
(SEE ACCOUNTING) 



-368 



ESTABUSH SESSION 
TELLER B— ► MG 



—190-258 



TRANSFERS) NOTES 

MG-»TELLERB 



—750-770 



TO BANK B l, ovn 
POST TRANSACTION ACCOUNTING d70 



(SEE ACCOUNTING) 



TRANSFER (£) NOTES 

TELLER B -► A 



—750-770 



COMMIT 

A -►TELLER B 



—690-698 



COMMIT 

TELLER B -►MG 



FOREIGN EXCHANGE - ISSUING BANK 



SUBSTITUTE SHEET 



PCT/US92/09732 



s SET UP FOREIGN EXCHANGE h -334-366 FIG.49 



TO BANK B 



-372 



ESTABUSH SESSION 

TELLER B -►TELLER C 



-190-258 



REQUEST (£) WITHDRAWAL 

T ELLER B-+1B.I &C 



-920-928 



ESTABUSH SESSION _ 1 Qn ORa 
TELLER C-»MG 1^-190-258 



REQUEST (£) NOTES 

TELLER C— ►MG 



-780-792 



TO BANK C 

POST ACCOUNTING TRANSACTIONS 374 
(SEE ACCOUNTING) 



IE 



TRANSFER (£) NOTES L_ 7 c n vvn 
TELLER C-^TELLERB 750-770 



TRANSFER (£) NOTES L_ 75 o-770 
TELLER B-V A 750-770 



COMMIT 

A— ►TELLER B 



COMMIT 

TELLER B -►TELLER C 



—690-698 



COMMIT 
TELLER C-»MG 



FOREIGN EXCHANGE - CORRESPONDENT BANK 



SUBSTITUTE SHEET 



WO 93/10503 



PCT/US92/09732 



67/68 

FIG. 50 



| A SIGNS ON MONEY MODULeV -1 0-42 



TO SUBSCRIBER A 

PROMPT FOR TRANSACTION F~570 



A PICKS UPDATE NOTES AND 
CERTIFICATE 



—572 



MONEY MODULE A 
NETWORK SIGN ON 



— 50-16 



SESSION MANAGER A 

SEND o REpUESTTOUPDATE 



--574 



NETWORK SERVER 

SEND SELECTED BANK 
IDENTIFIER TO MONEY MODULE 



—576 



ESTABLISH SESSION 

A— ► TELLER B 



—190-258 



TO TELLER A , „ Q 

SEND UPDATE NOTES REQUEST h~578 



SEND MESSAGE , n n 
A-*- TELLER B M2-8 



UPDATE MONEY MODULE NOTES AND CERTIFICATE 



SUBSTITUTE SHEET 



WO 93/10503 



PCT/US92/09732 



FIG. 50A 



9 



TO TRANSACTOR B 

SEND ACKNOWLEDGEMENT 

I 



^-580 



SEND MESSAGE 

TELLER B— ►A 

IE 



TRANSFER NOTES 

A-^TELLERB 



-2-8 



-750-770 



TO BANK B 

POST ACCOUNTING TRANSACTION 
(SEE ACCOUNTING) 

I 



—582 



ESTABUSH SESSION 

TELLER B — ► MG 



REQUEST NOTES 

TELLER B—»MG 



-190-258 



-780-792 



7I W SF S! , SP h-750-770 
MG-^TELLER B 



TO BANK B 

POST A g^{^^ J^jjS^^N 



—584 



TRANSFER NOTES 

TELLER B—^ A 



-750-770 



COMMIT 

A-HHJLERB 



—690-698 



COMMIT 

TELLER B—»MG 



—690-698 



(^END^) 

| UPDATE MONEY MODULE NOTES AND CERTIFICATE (CONTINUED) | 
SUBSTITUTE SHEET 



INTERNATIONAL SEARCH REPORT 



CLASSIFICATION OF SUBJECT MATTER 
IPC(5) :G06FlS/30 
US CL 364/401/408:1; 2.35/379,380 



1: 



PCT/US92/09732 



According to International Patent Classification (IPC) or to both n, 
B. HELPS SEARCHED ~ 



U.S. : 364/401/408;!; 2.35/379,380 



-e included in the fields searched 



(name of data base and, where practicable, s< 
electronics found 8 



C. DOCUMENTS CONSIDERED TO BE RELEVANT 



Citation of document, with indication. 



where appropriate, of the relevant 



Sumem 625 ' 276 (Bent ° n Ct ^ 25 N ° Vember 1986 see e »tire 
US.A, 4,454,414 (Benton) 12 June 1984 see entire document. 

US, A , 4.906,825, (Halpem) 06 March 1990, see 
entire document 



1-66 
1-66 




Form PCT/ISA/210 (second sheet)(July 1992)* 



